<!doctype html><html lang="en"><head><title data-rh="true">Configuring Linux auditd for Threat Detection | by IzyKnows | Medium</title><meta data-rh="true" charset="utf-8"/><meta data-rh="true" name="viewport" content="width=device-width,minimum-scale=1,initial-scale=1,maximum-scale=1"/><meta data-rh="true" name="theme-color" content="#000000"/><meta data-rh="true" name="twitter:app:name:iphone" content="Medium"/><meta data-rh="true" name="twitter:app:id:iphone" content="828256236"/><meta data-rh="true" property="al:ios:app_name" content="Medium"/><meta data-rh="true" property="al:ios:app_store_id" content="828256236"/><meta data-rh="true" property="al:android:package" content="com.medium.reader"/><meta data-rh="true" property="fb:app_id" content="542599432471018"/><meta data-rh="true" property="og:site_name" content="Medium"/><meta data-rh="true" property="og:type" content="article"/><meta data-rh="true" property="article:published_time" content="2022-01-27T09:11:16.275Z"/><meta data-rh="true" name="title" content="Configuring Linux auditd for Threat Detection | by IzyKnows | Medium"/><meta data-rh="true" property="og:title" content="Linux Auditd for Threat Detection"/><meta data-rh="true" property="twitter:title" content="Linux Auditd for Threat Detection"/><meta data-rh="true" name="twitter:site" content="@Medium"/><meta data-rh="true" name="twitter:app:url:iphone" content="medium://p/d06c8b941505"/><meta data-rh="true" property="al:android:url" content="medium://p/d06c8b941505"/><meta data-rh="true" property="al:ios:url" content="medium://p/d06c8b941505"/><meta data-rh="true" property="al:android:app_name" content="Medium"/><meta data-rh="true" name="description" content="A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large organization. While I had a fair understanding of Linux systems, I…"/><meta data-rh="true" property="og:description" content="A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large…"/><meta data-rh="true" property="twitter:description" content="A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large…"/><meta data-rh="true" property="og:url" content="https://izyknows.medium.com/linux-auditd-for-threat-detection-d06c8b941505"/><meta data-rh="true" property="al:web:url" content="https://izyknows.medium.com/linux-auditd-for-threat-detection-d06c8b941505"/><meta data-rh="true" property="og:image" content="https://miro.medium.com/max/660/0*cpEg2_eJmcCq1CZW.png"/><meta data-rh="true" name="twitter:image:src" content="https://miro.medium.com/max/660/0*cpEg2_eJmcCq1CZW.png"/><meta data-rh="true" name="twitter:card" content="summary_large_image"/><meta data-rh="true" property="article:author" content="https://izyknows.medium.com"/><meta data-rh="true" name="author" content="IzyKnows"/><meta data-rh="true" name="robots" content="index,follow,max-image-preview:large"/><meta data-rh="true" name="referrer" content="unsafe-url"/><meta data-rh="true" name="twitter:label1" content="Reading time"/><meta data-rh="true" name="twitter:data1" content="9 min read"/><link data-rh="true" rel="icon" href="https://miro.medium.com/1*m-R_BkNf1Qjr1YbyOIJY2w.png"/><link data-rh="true" rel="search" type="application/opensearchdescription+xml" title="Medium" href="/osd.xml"/><link data-rh="true" rel="apple-touch-icon" sizes="152x152" href="https://miro.medium.com/fit/c/152/152/1*sHhtYhaCe2Uc3IU0IgKwIQ.png"/><link data-rh="true" rel="apple-touch-icon" sizes="120x120" href="https://miro.medium.com/fit/c/120/120/1*sHhtYhaCe2Uc3IU0IgKwIQ.png"/><link data-rh="true" rel="apple-touch-icon" sizes="76x76" href="https://miro.medium.com/fit/c/76/76/1*sHhtYhaCe2Uc3IU0IgKwIQ.png"/><link data-rh="true" rel="apple-touch-icon" sizes="60x60" href="https://miro.medium.com/fit/c/60/60/1*sHhtYhaCe2Uc3IU0IgKwIQ.png"/><link data-rh="true" rel="mask-icon" href="https://cdn-static-1.medium.com/_/fp/icons/Medium-Avatar-500x500.svg" color="#171717"/><link data-rh="true" rel="preconnect" href="https://glyph.medium.com" crossOrigin=""/><link data-rh="true" id="glyph_preload_link" rel="preload" as="style" type="text/css" href="https://glyph.medium.com/css/unbound.css"/><link data-rh="true" id="glyph_link" rel="stylesheet" type="text/css" href="https://glyph.medium.com/css/unbound.css"/><link data-rh="true" rel="author" href="https://izyknows.medium.com"/><link data-rh="true" rel="canonical" href="https://izyknows.medium.com/linux-auditd-for-threat-detection-d06c8b941505"/><link data-rh="true" rel="alternate" href="android-app://com.medium.reader/https/medium.com/p/d06c8b941505"/><script data-rh="true" type="application/ld+json">{"@context":"http:\u002F\u002Fschema.org","@type":"NewsArticle","image":["https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F1200\u002F0*cpEg2_eJmcCq1CZW.png"],"url":"https:\u002F\u002Fizyknows.medium.com\u002Flinux-auditd-for-threat-detection-d06c8b941505","dateCreated":"2022-01-26T09:03:22.663Z","datePublished":"2022-01-26T09:03:22.663Z","dateModified":"2022-01-29T02:34:00.762Z","headline":"Configuring Linux auditd for Threat Detection - IzyKnows - Medium","name":"Configuring Linux auditd for Threat Detection - IzyKnows - Medium","description":"A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large organization. While I had a fair understanding of Linux systems, I…","identifier":"d06c8b941505","author":{"@type":"Person","name":"IzyKnows","url":"https:\u002F\u002Fizyknows.medium.com"},"creator":["IzyKnows"],"publisher":{"@type":"Organization","name":"Medium","url":"https:\u002F\u002Fizyknows.medium.com\u002F","logo":{"@type":"ImageObject","width":308,"height":60,"url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F616\u002F1*OMF3fSqH8t4xBJ9-6oZDZw.png"}},"mainEntityOfPage":"https:\u002F\u002Fizyknows.medium.com\u002Flinux-auditd-for-threat-detection-d06c8b941505"}</script><style type="text/css" data-fela-rehydration="564" data-fela-type="STATIC">html{box-sizing:border-box}*, *:before, *:after{box-sizing:inherit}body{margin:0;padding:0;text-rendering:optimizeLegibility;-webkit-font-smoothing:antialiased;color:rgba(0,0,0,0.8);position:relative;min-height:100vh}h1, h2, h3, h4, h5, h6, dl, dd, ol, ul, menu, figure, blockquote, p, pre, form{margin:0}menu, ol, ul{padding:0;list-style:none;list-style-image:none}main{display:block}a{color:inherit;text-decoration:none}a, button, input{-webkit-tap-highlight-color:transparent}img, svg{vertical-align:middle}button{background:transparent;overflow:visible}button, input, optgroup, select, textarea{margin:0}:root{--reach-tabs:1;--reach-menu-button:1}#speechify-root{font-family:Sohne, sans-serif}div[data-popper-reference-hidden="true"]{visibility:hidden;pointer-events:none}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="KEYFRAME">@-webkit-keyframes k1{0%{transform:scale(1)}50%{transform:scale(1.1)}100%{transform:scale(1)}}@-moz-keyframes k1{0%{transform:scale(1)}50%{transform:scale(1.1)}100%{transform:scale(1)}}@keyframes k1{0%{transform:scale(1)}50%{transform:scale(1.1)}100%{transform:scale(1)}}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE">.a{font-family:medium-content-sans-serif-font, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue", sans-serif}.b{font-weight:400}.c{background-color:rgba(255, 255, 255, 1)}.l{display:block}.m{margin:auto}.n{max-width:1504px}.o{display:flex}.u{justify-content:space-between}.ag{height:100%}.al{padding:0 24px}.am{box-shadow:0px -2px 10px rgba(0, 0, 0, 0.15)}.an{height:56px}.ao{align-items:center}.ap{position:fixed}.aq{top:0}.ar{right:0}.as{left:0}.at{z-index:500}.au{color:inherit}.av{fill:inherit}.aw{font-size:inherit}.ax{border:inherit}.ay{font-family:inherit}.az{letter-spacing:inherit}.ba{font-weight:inherit}.bb{padding:0}.bc{margin:0}.bg:disabled{cursor:default}.bh:disabled{color:rgba(117, 117, 117, 1)}.bi:disabled{fill:rgba(117, 117, 117, 1)}.bj{height:25px}.bk{fill:rgba(41, 41, 41, 1)}.bl{padding-top:0px}.bm{text-align:center}.bn{font-family:sohne, "Helvetica Neue", Helvetica, Arial, sans-serif}.bo{font-size:14px}.bp{line-height:20px}.bq{color:rgba(242, 242, 242, 1)}.br{padding:7px 16px 9px}.bs{fill:rgba(242, 242, 242, 1)}.bt{background:rgba(242, 242, 242, 1)}.bu{border-color:rgba(242, 242, 242, 1)}.ca:disabled{cursor:inherit !important}.cb:disabled{opacity:0.1}.cc:disabled:hover{background:rgba(25, 25, 25, 1)}.cd:disabled:hover{border-color:rgba(25, 25, 25, 1)}.ce{border-radius:99em}.cf{width:100%}.cg{border-width:1px}.ch{border-style:solid}.ci{box-sizing:border-box}.cj{display:inline-block}.ck{text-decoration:none}.cl{margin-left:16px}.cm{display:none}.co{color:rgba(117, 117, 117, 1)}.cp{color:rgba(26, 137, 23, 1)}.cq{fill:rgba(26, 137, 23, 1)}.ct:disabled{color:rgba(163, 208, 162, 0.5)}.cu:disabled{fill:rgba(163, 208, 162, 0.5)}.da{height:100vh}.db{flex-direction:column}.dc{position:sticky}.dd{z-index:1}.de{height:23px}.df{padding-bottom:35px}.dg{fill:rgba(117, 117, 117, 1)}.dh{padding-left:28px}.di{transition:all 0.2s ease-in-out}.dm{margin-right:28px}.do{font-size:16px}.dp{line-height:24px}.dq{position:relative}.dr{margin:0px 0px 35px 28px }.ds{width:24px}.dt{border:0}.du{height:1px}.dv{background-color:rgba(230, 230, 230, 1)}.dw{padding:0 24px 24px}.dx{height:64px}.dy path{fill:rgba(168, 168, 168, 1)}.dz{justify-content:center}.ea{flex:1}.eb{border:none}.ec{background:transparent}.ed{box-shadow:0px 2px 10px rgba(0, 0, 0, 0.15)}.ee{z-index:600}.ef{bottom:0}.eg{justify-content:space-around}.eh{height:16px}.ei{background-color:rgba(237, 237, 237, 1)}.eo{min-width:0}.ep{flex:1 1 auto}.eq{padding:0 32px}.er{border-left:1px solid rgba(230, 230, 230, 1)}.es{min-height:100vh}.et{width:394px}.fo{margin-left:auto}.fp{margin-right:auto}.fq{max-width:728px}.gb{align-items:flex-start}.gc{margin-right:16px}.gd{box-shadow:inset 0 0 0 1px rgba(0, 0, 0, 0.05)}.ge{border-radius:50%}.gf{height:48px}.gg{width:48px}.gh{position:absolute}.gi{background-color:rgba(242, 242, 242, 1)}.gj{color:rgba(41, 41, 41, 1)}.gk{margin-bottom:4px}.gl{flex-direction:row}.gm{padding-left:12px}.gr{font-size:13px}.gs{color:rgba(255, 255, 255, 1)}.gt{padding:0px 8px 1px}.gu{fill:rgba(255, 255, 255, 1)}.gv{background:rgba(26, 137, 23, 1)}.gw{border-color:rgba(26, 137, 23, 1)}.gz:disabled{opacity:0.3}.ha:disabled:hover{background:rgba(26, 137, 23, 1)}.hb:disabled:hover{border-color:rgba(26, 137, 23, 1)}.hc{flex-wrap:wrap}.hd{padding:0 8px}.hh{padding-right:4px}.hi{flex:0 0 auto}.hj{padding:8px 2px}.hl{margin:0 4px 0 28px}.hm{display:inline-flex}.hn{padding-top:24px}.hq{padding-right:12px}.hr{background:rgba(255, 255, 255, 1)}.hs{border:1px solid rgba(230, 230, 230, 1)}.ht{border-radius:4px}.hu{box-shadow:0 1px 4px rgba(230, 230, 230, 1)}.hv{max-height:100vh}.hw{overflow-y:auto}.hx{top:calc(100vh + 100px)}.hy{bottom:calc(100vh + 100px)}.hz{width:10px}.ia{pointer-events:none}.ib{word-break:break-word}.ic{word-wrap:break-word}.id:after{display:block}.ie:after{content:""}.if:after{clear:both}.ig{line-height:1.23}.ih{letter-spacing:0}.ii{font-style:normal}.ij{font-weight:700}.je{margin-bottom:-0.27em}.jf{line-height:1.58}.jg{letter-spacing:-0.004em}.jh{font-family:charter, Georgia, Cambria, "Times New Roman", Times, serif}.kc{margin-bottom:-0.46em}.kd{line-height:28px}.ke{letter-spacing:-0.003em}.ki{list-style-type:disc}.kj{margin-left:30px}.kk{padding-left:0px}.kl{font-size:18px}.kr{margin-top:32px}.ks{margin-bottom:14px}.kt{padding-bottom:10px}.ku{background-color:rgba(8, 8, 8, 1)}.kv{height:3px}.kw{width:3px}.kx{margin-right:20px}.ky{line-height:1.31}.kz{letter-spacing:-0.022em}.la{font-weight:600}.lv{margin-bottom:-0.37em}.mb{text-decoration:underline}.mc{max-width:660px}.mh{clear:both}.mi{max-width:100%}.mj{height:auto}.mk{margin-top:10px}.ms{box-shadow:inset 3px 0 0 0 rgba(41, 41, 41, 1)}.mt{padding-left:23px}.mu{margin-left:-20px}.mv{font-style:italic}.mz{max-width:1085px}.nb{cursor:zoom-in}.nc{z-index:auto}.ne{max-width:3355px}.nf{max-width:1256px}.ng{padding:16px 0 0}.nh{opacity:1}.ni{transition:opacity 300ms}.nj{bottom:16px}.nk{padding:0 14px 0 16px}.nl{border-radius:20px}.nm{box-shadow:0px 2px 10px 0px rgba(0, 0, 0, 0.1)}.nn{height:40px}.no{margin-right:5px}.nr{-webkit-user-select:none}.ns{cursor:progress}.nv{opacity:0.25}.nw{outline:0}.nx{user-select:none}.ny> svg{pointer-events:none}.oh{border-right:1px solid rgba(230, 230, 230, 1)}.oi{margin:0 16px}.oj{height:12px}.ok{cursor:pointer}.ol{padding:4px 0}.oo{border-top:none}.op{height:52px}.oq{max-height:52px}.or{box-sizing:content-box}.os{position:static}.ot{flex:1 0 auto}.ov{max-width:155px}.pa{margin-left:24px}.pb{margin-top:0px}.pc path{fill:rgba(117, 117, 117, 1)}.pe{margin:0 20px}.pf{background-color:rgba(250, 250, 250, 1)}.pg{padding-bottom:4px}.ph{padding-top:32px}.pi{font-weight:500}.pv{overflow:hidden}.pw{text-overflow:ellipsis}.px{display:-webkit-box}.py{-webkit-line-clamp:1}.pz{-webkit-box-orient:vertical}.qa{word-break:break-all}.qc{margin-left:8px}.qd{stroke:rgba(242, 242, 242, 1)}.qe{height:36px}.qf{width:36px}.qg{padding-top:5px}.qh{padding-top:25px}.qi{padding-bottom:96px}.qj{padding-left:16px}.qk{padding-top:40px}.ql{padding-right:16px}.rb{background:rgba(25, 25, 25, 1)}.rc{border-color:rgba(25, 25, 25, 1)}.rf{padding-bottom:80px}.rg{padding-bottom:26px}.sq{flex-grow:0}.sr{padding-bottom:8px}.ss{margin-bottom:24px}.st{margin-right:24px}.su{flex:1 0 0%}.sv{margin-bottom:8px}.sw{margin-right:8px}.sx{height:20px}.sy{width:20px}.sz{max-height:20px}.ta{max-height:60px}.tb{-webkit-line-clamp:3}.tc{width:56px}.td{padding-bottom:100%}.te{height:0}.tf{border-radius:2px}.tg{padding:30px 0}.th{margin-bottom:0}.ti{min-width:100vw}.tj{background-color:rgba(0, 0, 0, 1)}.to{max-width:1192px}.tr:disabled{color:rgba(255, 255, 255, 0.6)}.ts:disabled{fill:rgba(255, 255, 255, 0.45)}.tt{height:22px}.tu{margin-top:20px}.tv{color:rgba(255, 255, 255, 0.95)}.tx{background-color:rgba(255, 255, 255, 0.4)}.ty{margin:28px 0 20px}.tz{padding:40px 0}.ua{width:inherit}.ub{outline:none}.uc{padding:8px 0 11px}.ud{background-color:transparent}.ue::placeholder{color:rgba(117, 117, 117, 1)}.uf{padding:7px 7px 6px 8px}.ug{margin-top:40px}.uh{height:88px}.ui{width:88px}.uj{margin-top:16px}.uk{margin-top:4px}.ul{margin-top:12px}.um{margin-top:24px}.un{margin-bottom:40px}.uo{width:auto}.up{padding:24px 0}.uq{margin-right:6px}.ur{font-size:11px}.us{line-height:16px}.bd:hover{cursor:pointer}.be:hover{color:rgba(25, 25, 25, 1)}.bf:hover{fill:rgba(25, 25, 25, 1)}.bv:hover{background:rgba(242, 242, 242, 1)}.bw:hover{border-color:rgba(242, 242, 242, 1)}.bx:hover{cursor:wait}.by:hover{color:rgba(242, 242, 242, 1)}.bz:hover{fill:rgba(242, 242, 242, 1)}.cr:hover{color:rgba(15, 115, 12, 1)}.cs:hover{fill:rgba(15, 115, 12, 1)}.dj:hover{color:rgba(41, 41, 41, 1)}.dk:hover{fill:rgba(41, 41, 41, 1)}.gx:hover{background:rgba(15, 115, 12, 1)}.gy:hover{border-color:rgba(15, 115, 12, 1)}.hk:hover path{fill:rgba(8, 8, 8, 1)}.nu:hover{fill:rgba(117, 117, 117, 1)}.om:hover{fill:rgba(8, 8, 8, 1)}.on:hover p{color:rgba(8, 8, 8, 1)}.rd:hover{background:rgba(8, 8, 8, 1)}.re:hover{border-color:rgba(41, 41, 41, 1)}.tp:hover{color:rgba(255, 255, 255, 1)}.tq:hover{fill:rgba(255, 255, 255, 0.9)}.tw:hover{text-decoration:underline}.nd:focus{transform:scale(1.01)}.nt:focus{fill:rgba(117, 117, 117, 1)}.pd:focus path{fill:rgba(8, 8, 8, 1)}.nz:active{border-style:none}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (min-width: 1080px)">.d{display:none}.t{flex-direction:row}.z{width:80px}.ab{min-height:100vh}.ac{flex-shrink:1}.ae{border-right:1px solid rgba(230, 230, 230, 1)}.cv{display:block}.cw{text-align:center}.cx{padding:40px 0}.en{margin-bottom:0}.ez{margin-bottom:40px}.fg{margin:0 32px}.fh{max-width:692px}.fn{padding:0 16px}.fz{margin-bottom:32px}.ga{margin-top:56px}.hg{display:inline-flex}.ja{font-size:32px}.jb{margin-top:0.6em}.jc{line-height:40px}.jd{letter-spacing:-0.016em}.jy{font-size:20px}.jz{margin-top:2em}.ka{line-height:32px}.kb{letter-spacing:-0.003em}.kh{margin-top:2.14em}.kq{margin-top:1.14em}.lr{font-size:22px}.ls{margin-top:2.05em}.lt{line-height:28px}.lu{letter-spacing:0}.ma{margin-top:0.86em}.mr{margin-top:3.14em}.my{font-size:21px}.og{margin-top:0px}.oz{display:inline-block}.pt{line-height:24px}.pu{max-height:24px}.qq{margin:0}.qv{white-space:normal}.ra{margin:0 0 0 12px}.rt{width:calc(100% + 64px)}.ru{margin-left:-32px}.rv{margin-right:-32px}.sm{padding-left:32px}.sn{padding-right:32px}.so{flex-basis:50%}.sp{max-width:50%}.tn{margin:0 64px}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (max-width: 1079.98px)">.e{display:none}.ml{margin-left:auto}.mm{text-align:center}.of{margin-top:0px}.oy{display:inline-block}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (max-width: 903.98px)">.f{display:none}.oe{margin-top:0px}.ox{display:inline-block}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (max-width: 727.98px)">.g{display:none}.cn{display:block}.oc{margin-top:0px}.od{margin-right:0px}.ow{display:inline-block}.tk{padding:24px 0}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (max-width: 551.98px)">.h{display:none}.p{flex-direction:column}.v{width:auto}.ah{display:block}.ej{margin-bottom:56px}.ev{margin-bottom:80px}.fa{margin:0 24px}.fj{padding:0 8px}.fr{margin-bottom:24px}.fs{margin-top:32px}.gn{display:inline-block}.ho{display:flex}.ik{font-size:32px}.il{margin-top:0.64em}.im{line-height:40px}.in{letter-spacing:-0.016em}.ji{font-size:18px}.jj{margin-top:1.56em}.jk{line-height:28px}.jl{letter-spacing:-0.003em}.km{margin-top:1.34em}.lb{font-size:20px}.lc{margin-top:1.5em}.ld{line-height:24px}.le{letter-spacing:0}.lw{margin-top:0.67em}.md{margin-top:40px}.mn{margin-top:1.9em}.np{margin-left:0px}.oa{margin-top:0px}.ob{margin-right:0px}.pj{font-size:16px}.pk{line-height:20px}.pl{max-height:20px}.qm{margin:0}.qr{white-space:pre-line}.qw{margin:10px 0 0 0}.rh{width:calc(100% + 24px)}.ri{margin-left:-12px}.rj{margin-right:-12px}.rw{padding-left:12px}.rx{padding-right:12px}.ry{flex-basis:100%}.rz{max-width:100%}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (min-width: 904px) and (max-width: 1079.98px)">.i{display:none}.s{flex-direction:column}.y{width:auto}.ak{display:block}.em{margin-bottom:56px}.ey{margin-bottom:40px}.fe{margin:0 32px}.ff{max-width:692px}.fm{padding:0 16px}.fx{margin-bottom:24px}.fy{margin-top:32px}.gq{display:inline-block}.hf{display:inline-flex}.iw{font-size:32px}.ix{margin-top:0.6em}.iy{line-height:40px}.iz{letter-spacing:-0.016em}.ju{font-size:20px}.jv{margin-top:2em}.jw{line-height:32px}.jx{letter-spacing:-0.003em}.kg{margin-top:2.14em}.kp{margin-top:1.14em}.ln{font-size:22px}.lo{margin-top:2.05em}.lp{line-height:28px}.lq{letter-spacing:0}.lz{margin-top:0.86em}.mg{margin-top:56px}.mq{margin-top:3.14em}.mx{font-size:21px}.pr{line-height:24px}.ps{max-height:24px}.qp{margin:0}.qu{white-space:normal}.qz{margin:0 0 0 12px}.rq{width:calc(100% + 64px)}.rr{margin-left:-32px}.rs{margin-right:-32px}.si{padding-left:32px}.sj{padding-right:32px}.sk{flex-basis:50%}.sl{max-width:50%}.tm{margin:0 64px}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (min-width: 728px) and (max-width: 903.98px)">.j{display:none}.r{flex-direction:column}.x{width:auto}.aj{display:block}.el{margin-bottom:56px}.ex{margin-bottom:40px}.fc{margin:0 32px}.fd{max-width:692px}.fl{padding:0 16px}.fv{margin-bottom:24px}.fw{margin-top:32px}.gp{display:inline-block}.he{display:inline-flex}.is{font-size:32px}.it{margin-top:0.6em}.iu{line-height:40px}.iv{letter-spacing:-0.016em}.jq{font-size:20px}.jr{margin-top:2em}.js{line-height:32px}.jt{letter-spacing:-0.003em}.kf{margin-top:2.14em}.ko{margin-top:1.14em}.lj{font-size:22px}.lk{margin-top:2.05em}.ll{line-height:28px}.lm{letter-spacing:0}.ly{margin-top:0.86em}.mf{margin-top:56px}.mp{margin-top:3.14em}.mw{font-size:21px}.pp{line-height:24px}.pq{max-height:24px}.qo{margin:0}.qt{white-space:normal}.qy{margin:0 0 0 12px}.rn{width:calc(100% + 64px)}.ro{margin-left:-32px}.rp{margin-right:-32px}.se{padding-left:32px}.sf{padding-right:32px}.sg{flex-basis:50%}.sh{max-width:50%}.tl{margin:0 48px}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (min-width: 552px) and (max-width: 727.98px)">.k{display:none}.q{flex-direction:column}.w{width:auto}.ai{display:block}.ek{margin-bottom:56px}.ew{margin-bottom:80px}.fb{margin:0 24px}.fk{padding:0 8px}.ft{margin-bottom:24px}.fu{margin-top:32px}.go{display:inline-block}.hp{display:flex}.io{font-size:32px}.ip{margin-top:0.64em}.iq{line-height:40px}.ir{letter-spacing:-0.016em}.jm{font-size:18px}.jn{margin-top:1.56em}.jo{line-height:28px}.jp{letter-spacing:-0.003em}.kn{margin-top:1.34em}.lf{font-size:20px}.lg{margin-top:1.5em}.lh{line-height:24px}.li{letter-spacing:0}.lx{margin-top:0.67em}.me{margin-top:40px}.mo{margin-top:1.9em}.nq{margin-left:0px}.pm{font-size:16px}.pn{line-height:20px}.po{max-height:20px}.qn{margin:0}.qs{white-space:pre-line}.qx{margin:10px 0 0 0}.rk{width:calc(100% + 64px)}.rl{margin-left:-32px}.rm{margin-right:-32px}.sa{padding-left:32px}.sb{padding-right:32px}.sc{flex-basis:50%}.sd{max-width:50%}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="print">.ou{display:none}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (min-width: 7000px)">.af{width:224px}.cy{text-align:left}.cz{padding:40px 24px}.dl{display:none}.dn{display:block}.fi{margin:0 auto}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="all and (max-width: 1239.98px)">.eu{width:280px}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="(prefers-reduced-motion: no-preference)">.na{transition:transform 300ms cubic-bezier(0.2, 0, 0.2, 1)}</style><style type="text/css" data-fela-rehydration="564" data-fela-type="RULE" media="(orientation: landscape) and (max-width: 903.98px)">.qb{max-height:none}</style></head><body><div id="root"><div class="a b c"><div class="d e f g h i j k"></div><script>document.domain = document.domain;</script><div class="l c"><div class="m n l"><div class="o p q r s t u"><div class="v w x y z ab ac ae af"><nav class="ag"><div class="ah ai aj ak d"><div class="al am an o ao u ap aq ar as at c"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" aria-label="Homepage" href="https://medium.com/" rel="noopener follow"><svg viewBox="0 0 1043.63 592.71" class="bj bk"><g data-name="Layer 2"><g data-name="Layer 1"><path d="M588.67 296.36c0 163.67-131.78 296.35-294.33 296.35S0 460 0 296.36 131.78 0 294.34 0s294.33 132.69 294.33 296.36M911.56 296.36c0 154.06-65.89 279-147.17 279s-147.17-124.94-147.17-279 65.88-279 147.16-279 147.17 124.9 147.17 279M1043.63 296.36c0 138-23.17 249.94-51.76 249.94s-51.75-111.91-51.75-249.94 23.17-249.94 51.75-249.94 51.76 111.9 51.76 249.94"></path></g></g></svg></a><div class="o ao"><div class="bl l bm"><div><a class="bn b bo bp bq br bs bt bu bv bw bx by bz ca cb cc cd ce cf cg ch ci cj ck" href="https://medium.com/plans?source=upgrade_membership---nav_full----------------------------------" rel="noopener follow">Get unlimited access</a></div></div><div class="cl cm cn"><span class="bn b bo bp co"><a class="cp cq aw ax ay az ba bb bc bd cr cs bg ct cu" href="https://rsci.app.link/?$canonical_url=https%3A%2F%2Fmedium.com/p/d06c8b941505&amp;~feature=LoOpenInAppButton&amp;~channel=ShowPostUnderUser&amp;~stage=mobileNavBar" rel="noopener follow">Open in app</a></span></div></div></div><div class="an l"></div></div><div class="ag h k j i cv"><div class="da o db u dc aq dd c"><div class="cw cx cy cz"><a aria-label="Homepage" href="https://medium.com/" rel="noopener follow"><svg viewBox="0 0 1043.63 592.71" class="de bk"><g data-name="Layer 2"><g data-name="Layer 1"><path d="M588.67 296.36c0 163.67-131.78 296.35-294.33 296.35S0 460 0 296.36 131.78 0 294.34 0s294.33 132.69 294.33 296.36M911.56 296.36c0 154.06-65.89 279-147.17 279s-147.17-124.94-147.17-279 65.88-279 147.16-279 147.17 124.9 147.17 279M1043.63 296.36c0 138-23.17 249.94-51.76 249.94s-51.75-111.91-51.75-249.94 23.17-249.94 51.75-249.94 51.76 111.9 51.76 249.94"></path></g></g></svg></a></div><div class="l"><div class="df l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/" rel="noopener follow"><div class="o dq"><div class="co dg o dh di dj dk"><div class="l dl dm"><div><div class="cj" aria-hidden="false"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Home"><path d="M4.5 10.75v10.5c0 .14.11.25.25.25h5c.14 0 .25-.11.25-.25v-5.5c0-.14.11-.25.25-.25h3.5c.14 0 .25.11.25.25v5.5c0 .14.11.25.25.25h5c.14 0 .25-.11.25-.25v-10.5M22 9l-9.1-6.83a1.5 1.5 0 0 0-1.8 0L2 9" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"></path></svg></div></div></div><div class="cm dn dm" aria-hidden="true"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Home"><path d="M4.5 10.75v10.5c0 .14.11.25.25.25h5c.14 0 .25-.11.25-.25v-5.5c0-.14.11-.25.25-.25h3.5c.14 0 .25.11.25.25v5.5c0 .14.11.25.25.25h5c.14 0 .25-.11.25-.25v-10.5M22 9l-9.1-6.83a1.5 1.5 0 0 0-1.8 0L2 9" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><div class="cm dn bn b do dp">Home</div></div></div></a></div><span><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/m/signin?operation=register&amp;redirect=https%3A%2F%2Fmedium.com%2Fme%2Fnotifications&amp;source=--------------------------notifications_sidenav-----------" rel="noopener follow"><div class="df l"><div class="o dq"><div class="co dg o dh di dj dk"><div class="l dl dm"><div><div class="cj" aria-hidden="false"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Notifications"><path d="M15 18.5a3 3 0 1 1-6 0" stroke="currentColor" stroke-linecap="round"></path><path d="M5.5 10.53V9a6.5 6.5 0 0 1 13 0v1.53c0 1.42.56 2.78 1.57 3.79l.03.03c.26.26.4.6.4.97v2.93c0 .14-.11.25-.25.25H3.75a.25.25 0 0 1-.25-.25v-2.93c0-.37.14-.71.4-.97l.03-.03c1-1 1.57-2.37 1.57-3.79z" stroke="currentColor" stroke-linejoin="round"></path></svg></div></div></div><div class="cm dn dm" aria-hidden="true"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Notifications"><path d="M15 18.5a3 3 0 1 1-6 0" stroke="currentColor" stroke-linecap="round"></path><path d="M5.5 10.53V9a6.5 6.5 0 0 1 13 0v1.53c0 1.42.56 2.78 1.57 3.79l.03.03c.26.26.4.6.4.97v2.93c0 .14-.11.25-.25.25H3.75a.25.25 0 0 1-.25-.25v-2.93c0-.37.14-.71.4-.97l.03-.03c1-1 1.57-2.37 1.57-3.79z" stroke="currentColor" stroke-linejoin="round"></path></svg></div><div class="cm dn bn b do dp">Notifications</div></div></div></div></a></span><span><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/m/signin?operation=register&amp;redirect=https%3A%2F%2Fmedium.com%2Fme%2Flists&amp;source=--------------------------lists_sidenav-----------" rel="noopener follow"><div class="df l"><div class="o dq"><div class="co dg o dh di dj dk"><div class="l dl dm"><div><div class="cj" aria-hidden="false"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Lists"><path d="M4.5 6.25V21c0 .2.24.32.4.2l5.45-4.09a.25.25 0 0 1 .3 0l5.45 4.09c.16.12.4 0 .4-.2V6.25a.25.25 0 0 0-.25-.25H4.75a.25.25 0 0 0-.25.25z" stroke="currentColor" stroke-linecap="round"></path><path d="M8 6V3.25c0-.14.11-.25.25-.25h11.5c.14 0 .25.11.25.25V16.5" stroke="currentColor" stroke-linecap="round"></path></svg></div></div></div><div class="cm dn dm" aria-hidden="true"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Lists"><path d="M4.5 6.25V21c0 .2.24.32.4.2l5.45-4.09a.25.25 0 0 1 .3 0l5.45 4.09c.16.12.4 0 .4-.2V6.25a.25.25 0 0 0-.25-.25H4.75a.25.25 0 0 0-.25.25z" stroke="currentColor" stroke-linecap="round"></path><path d="M8 6V3.25c0-.14.11-.25.25-.25h11.5c.14 0 .25.11.25.25V16.5" stroke="currentColor" stroke-linecap="round"></path></svg></div><div class="cm dn bn b do dp">Lists</div></div></div></div></a></span><span><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/m/signin?operation=register&amp;redirect=https%3A%2F%2Fmedium.com%2Fme%2Fstories%2Fdrafts&amp;source=--------------------------stories_sidenav-----------" rel="noopener follow"><div class="df l"><div class="o dq"><div class="co dg o dh di dj dk"><div class="l dl dm"><div><div class="cj" aria-hidden="false"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Stories"><path d="M4.75 21.5h14.5c.14 0 .25-.11.25-.25V2.75a.25.25 0 0 0-.25-.25H4.75a.25.25 0 0 0-.25.25v18.5c0 .14.11.25.25.25z" stroke="currentColor"></path><path d="M8 8.5h8M8 15.5h5M8 12h8" stroke="currentColor" stroke-linecap="round"></path></svg></div></div></div><div class="cm dn dm" aria-hidden="true"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Stories"><path d="M4.75 21.5h14.5c.14 0 .25-.11.25-.25V2.75a.25.25 0 0 0-.25-.25H4.75a.25.25 0 0 0-.25.25v18.5c0 .14.11.25.25.25z" stroke="currentColor"></path><path d="M8 8.5h8M8 15.5h5M8 12h8" stroke="currentColor" stroke-linecap="round"></path></svg></div><div class="cm dn bn b do dp">Stories</div></div></div></div></a></span><div class="dr ds l"><hr class="dt du dv bc" aria-hidden="true"/></div><span><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/m/signin?operation=register&amp;redirect=https%3A%2F%2Fmedium.com%2Fnew-story&amp;source=--------------------------new_post_sidenav-----------" rel="noopener follow"><div class="df l"><div class="o dq"><div class="co dg o dh di dj dk"><div class="l dl dm"><div><div class="cj" aria-hidden="false"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Write"><path d="M14 4a.5.5 0 0 0 0-1v1zm7 6a.5.5 0 0 0-1 0h1zm-7-7H4v1h10V3zM3 4v16h1V4H3zm1 17h16v-1H4v1zm17-1V10h-1v10h1zm-1 1a1 1 0 0 0 1-1h-1v1zM3 20a1 1 0 0 0 1 1v-1H3zM4 3a1 1 0 0 0-1 1h1V3z" fill="currentColor"></path><path d="M17.5 4.5l-8.46 8.46a.25.25 0 0 0-.06.1l-.82 2.47c-.07.2.12.38.31.31l2.47-.82a.25.25 0 0 0 .1-.06L19.5 6.5m-2-2l2.32-2.32c.1-.1.26-.1.36 0l1.64 1.64c.1.1.1.26 0 .36L19.5 6.5m-2-2l2 2" stroke="currentColor"></path></svg></div></div></div><div class="cm dn dm" aria-hidden="true"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-label="Write"><path d="M14 4a.5.5 0 0 0 0-1v1zm7 6a.5.5 0 0 0-1 0h1zm-7-7H4v1h10V3zM3 4v16h1V4H3zm1 17h16v-1H4v1zm17-1V10h-1v10h1zm-1 1a1 1 0 0 0 1-1h-1v1zM3 20a1 1 0 0 0 1 1v-1H3zM4 3a1 1 0 0 0-1 1h1V3z" fill="currentColor"></path><path d="M17.5 4.5l-8.46 8.46a.25.25 0 0 0-.06.1l-.82 2.47c-.07.2.12.38.31.31l2.47-.82a.25.25 0 0 0 .1-.06L19.5 6.5m-2-2l2.32-2.32c.1-.1.26-.1.36 0l1.64 1.64c.1.1.1.26 0 .36L19.5 6.5m-2-2l2 2" stroke="currentColor"></path></svg></div><div class="cm dn bn b do dp">Write</div></div></div></div></a></span></div><div class="dw dx o ao"></div></div></div><div class="ah ai aj ak d"><div class="l ap ar ef as at c"><div class="ed an dq ee"><div class="ag o ao eg"><div class="eh ds l ei"></div><div class="eh ds l ei"></div><div class="eh ds l ei"></div></div></div></div></div></nav></div><main class="ej ek el em en eo l ep"><div class="l"><div class="ev ew ex ey ez l"><div class="o dz"><div class="eo cf fa fb fc fd fe ff fg fh fi"><article><div class="l"><div class="fj fk fl fm fn fo fp cf fq ci l"></div><div class="l"><header class="pw-post-byline-header fr fs ft fu fv fw fx fy fz ga l"><div class="o gb u"><div class="o"><div class="gc l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" rel="noopener follow" href="/?source=post_page-----d06c8b941505--------------------------------"><div class="l dq"><img alt="IzyKnows" class="l ci ge gf gg gi" src="https://miro.medium.com/fit/c/96/96/1*bxTMCz_6YjvWzrkEFA7-Zg.gif" width="48" height="48"/><div class="gd ge l gf gg gh aq"></div></div></a></div><div class="l"><div class="pw-author bn b do dp gj"><div class="gk o gl"><div><div class="cj" aria-hidden="false"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" rel="noopener follow" href="/?source=post_page-----d06c8b941505--------------------------------">IzyKnows</a></div></div><div class="gm gn go gp gq d"><span><button class="bn b gr bp gs gt gu gv gw gx gy bd ca gz ha hb ce cg ch ci cj ck">Follow</button></span></div></div></div><div class="o ao hc"><p class="pw-published-date bn b bo bp co"><span>Jan 26</span></p><div class="hd cj" aria-hidden="true"><span class="l" aria-hidden="true"><span class="bn b bo bp co">·</span></span></div><div class="pw-reading-time bn b bo bp co">9 min read</div></div></div></div><div class="o ao"><div class="h k he hf hg"><div class="hh l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi" aria-label="Share on twitter"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path d="M20 5.34c-.67.41-1.4.7-2.18.87a3.45 3.45 0 0 0-5.02-.1 3.49 3.49 0 0 0-1.02 2.47c0 .28.03.54.07.8a9.91 9.91 0 0 1-7.17-3.66 3.9 3.9 0 0 0-.5 1.74 3.6 3.6 0 0 0 1.56 2.92 3.36 3.36 0 0 1-1.55-.44V10c0 1.67 1.2 3.08 2.8 3.42-.3.06-.6.1-.94.12l-.62-.06a3.5 3.5 0 0 0 3.24 2.43 7.34 7.34 0 0 1-4.36 1.49l-.81-.05a9.96 9.96 0 0 0 5.36 1.56c6.4 0 9.91-5.32 9.9-9.9v-.5c.69-.49 1.28-1.1 1.74-1.81-.63.3-1.3.48-2 .56A3.33 3.33 0 0 0 20 5.33" fill="#A8A8A8"></path></svg></span></button></div></div></div><div class="hh l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi" aria-label="Share on facebook"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path d="M19.75 12.04c0-4.3-3.47-7.79-7.75-7.79a7.77 7.77 0 0 0-5.9 12.84 7.77 7.77 0 0 0 4.69 2.63v-5.49h-1.9v-2.2h1.9v-1.62c0-1.88 1.14-2.9 2.8-2.9.8 0 1.49.06 1.69.08v1.97h-1.15c-.91 0-1.1.43-1.1 1.07v1.4h2.17l-.28 2.2h-1.88v5.52a7.77 7.77 0 0 0 6.7-7.71" fill="#A8A8A8"></path></svg></span></button></div></div></div><div class="hh l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi" aria-label="Share on linkedin"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path d="M19.75 5.39v13.22a1.14 1.14 0 0 1-1.14 1.14H5.39a1.14 1.14 0 0 1-1.14-1.14V5.39a1.14 1.14 0 0 1 1.14-1.14h13.22a1.14 1.14 0 0 1 1.14 1.14zM8.81 10.18H6.53v7.3H8.8v-7.3zM9 7.67a1.31 1.31 0 0 0-1.3-1.32h-.04a1.32 1.32 0 0 0 0 2.64A1.31 1.31 0 0 0 9 7.71v-.04zm8.46 5.37c0-2.2-1.4-3.05-2.78-3.05a2.6 2.6 0 0 0-2.3 1.18h-.07v-1h-2.14v7.3h2.28V13.6a1.51 1.51 0 0 1 1.36-1.63h.09c.72 0 1.26.45 1.26 1.6v3.91h2.28l.02-4.43z" fill="#A8A8A8"></path></svg></span></button></div></div></div><div class="l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path fill-rule="evenodd" clip-rule="evenodd" d="M3.57 14.67c0-.57.13-1.11.38-1.6l.02-.02v-.02l.02-.02c0-.02 0-.02.02-.02.12-.26.3-.52.57-.8L7.78 9v-.02l.01-.02c.44-.41.91-.7 1.44-.85a4.87 4.87 0 0 0-1.19 2.36A5.04 5.04 0 0 0 8 11.6L6.04 13.6c-.19.19-.32.4-.38.65a2 2 0 0 0 0 .9c.08.2.2.4.38.57l1.29 1.31c.27.28.62.42 1.03.42.42 0 .78-.14 1.06-.42l1.23-1.25.79-.78 1.15-1.16c.08-.09.19-.22.28-.4.1-.2.15-.42.15-.67 0-.16-.02-.3-.06-.45l-.02-.02v-.02l-.07-.14s0-.03-.04-.06l-.06-.13-.02-.02c0-.02 0-.03-.02-.05a.6.6 0 0 0-.14-.16l-.48-.5c0-.04.02-.1.04-.15l.06-.12 1.17-1.14.09-.09.56.57c.02.04.08.1.16.18l.05.04.03.06.04.05.03.04.04.06.1.14.02.02c0 .02.01.03.03.04l.1.2v.02c.1.16.2.38.3.68a1 1 0 0 1 .04.25 3.2 3.2 0 0 1 .02 1.33 3.49 3.49 0 0 1-.95 1.87l-.66.67-.97.97-1.56 1.57a3.4 3.4 0 0 1-2.47 1.02c-.97 0-1.8-.34-2.49-1.03l-1.3-1.3a3.55 3.55 0 0 1-1-2.51v-.01h-.02v.02zm5.39-3.43c0-.19.02-.4.07-.63.13-.74.44-1.37.95-1.87l.66-.67.97-.98 1.56-1.56c.68-.69 1.5-1.03 2.47-1.03.97 0 1.8.34 2.48 1.02l1.3 1.32a3.48 3.48 0 0 1 1 2.48c0 .58-.11 1.11-.37 1.6l-.02.02v.02l-.02.04c-.14.27-.35.54-.6.8L16.23 15l-.01.02-.01.02c-.44.42-.92.7-1.43.83a4.55 4.55 0 0 0 1.23-3.52L18 10.38c.18-.21.3-.42.35-.65a2.03 2.03 0 0 0-.01-.9 1.96 1.96 0 0 0-.36-.58l-1.3-1.3a1.49 1.49 0 0 0-1.06-.42c-.42 0-.77.14-1.06.4l-1.2 1.27-.8.8-1.16 1.15c-.08.08-.18.21-.29.4a1.66 1.66 0 0 0-.08 1.12l.02.03v.02l.06.14s.01.03.05.06l.06.13.02.02.01.02.01.02c.05.08.1.13.14.16l.47.5c0 .04-.02.09-.04.15l-.06.12-1.15 1.15-.1.08-.56-.56a2.3 2.3 0 0 0-.18-.19c-.02-.01-.02-.03-.02-.04l-.02-.02a.37.37 0 0 1-.1-.12c-.03-.03-.05-.04-.05-.06l-.1-.15-.02-.02-.02-.04-.08-.17v-.02a5.1 5.1 0 0 1-.28-.69 1.03 1.03 0 0 1-.04-.26c-.06-.23-.1-.46-.1-.7v.01z" fill="#A8A8A8"></path></svg></span></button></div></div></div><div class="hl o ao"></div></div><div class="cl hm"><div><div class="cj" aria-hidden="false"></div></div></div></div></div><div class="hn ho hp j i d"><div class="gc l"></div><div class="hq l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi" aria-label="Share on twitter"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path d="M20 5.34c-.67.41-1.4.7-2.18.87a3.45 3.45 0 0 0-5.02-.1 3.49 3.49 0 0 0-1.02 2.47c0 .28.03.54.07.8a9.91 9.91 0 0 1-7.17-3.66 3.9 3.9 0 0 0-.5 1.74 3.6 3.6 0 0 0 1.56 2.92 3.36 3.36 0 0 1-1.55-.44V10c0 1.67 1.2 3.08 2.8 3.42-.3.06-.6.1-.94.12l-.62-.06a3.5 3.5 0 0 0 3.24 2.43 7.34 7.34 0 0 1-4.36 1.49l-.81-.05a9.96 9.96 0 0 0 5.36 1.56c6.4 0 9.91-5.32 9.9-9.9v-.5c.69-.49 1.28-1.1 1.74-1.81-.63.3-1.3.48-2 .56A3.33 3.33 0 0 0 20 5.33" fill="#A8A8A8"></path></svg></span></button></div></div></div><div class="hq l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi" aria-label="Share on facebook"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path d="M19.75 12.04c0-4.3-3.47-7.79-7.75-7.79a7.77 7.77 0 0 0-5.9 12.84 7.77 7.77 0 0 0 4.69 2.63v-5.49h-1.9v-2.2h1.9v-1.62c0-1.88 1.14-2.9 2.8-2.9.8 0 1.49.06 1.69.08v1.97h-1.15c-.91 0-1.1.43-1.1 1.07v1.4h2.17l-.28 2.2h-1.88v5.52a7.77 7.77 0 0 0 6.7-7.71" fill="#A8A8A8"></path></svg></span></button></div></div></div><div class="hq l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi" aria-label="Share on linkedin"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path d="M19.75 5.39v13.22a1.14 1.14 0 0 1-1.14 1.14H5.39a1.14 1.14 0 0 1-1.14-1.14V5.39a1.14 1.14 0 0 1 1.14-1.14h13.22a1.14 1.14 0 0 1 1.14 1.14zM8.81 10.18H6.53v7.3H8.8v-7.3zM9 7.67a1.31 1.31 0 0 0-1.3-1.32h-.04a1.32 1.32 0 0 0 0 2.64A1.31 1.31 0 0 0 9 7.71v-.04zm8.46 5.37c0-2.2-1.4-3.05-2.78-3.05a2.6 2.6 0 0 0-2.3 1.18h-.07v-1h-2.14v7.3h2.28V13.6a1.51 1.51 0 0 1 1.36-1.63h.09c.72 0 1.26.45 1.26 1.6v3.91h2.28l.02-4.43z" fill="#A8A8A8"></path></svg></span></button></div></div></div><div class="l hi"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi"><span class="cj hj dy hk"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path fill-rule="evenodd" clip-rule="evenodd" d="M3.57 14.67c0-.57.13-1.11.38-1.6l.02-.02v-.02l.02-.02c0-.02 0-.02.02-.02.12-.26.3-.52.57-.8L7.78 9v-.02l.01-.02c.44-.41.91-.7 1.44-.85a4.87 4.87 0 0 0-1.19 2.36A5.04 5.04 0 0 0 8 11.6L6.04 13.6c-.19.19-.32.4-.38.65a2 2 0 0 0 0 .9c.08.2.2.4.38.57l1.29 1.31c.27.28.62.42 1.03.42.42 0 .78-.14 1.06-.42l1.23-1.25.79-.78 1.15-1.16c.08-.09.19-.22.28-.4.1-.2.15-.42.15-.67 0-.16-.02-.3-.06-.45l-.02-.02v-.02l-.07-.14s0-.03-.04-.06l-.06-.13-.02-.02c0-.02 0-.03-.02-.05a.6.6 0 0 0-.14-.16l-.48-.5c0-.04.02-.1.04-.15l.06-.12 1.17-1.14.09-.09.56.57c.02.04.08.1.16.18l.05.04.03.06.04.05.03.04.04.06.1.14.02.02c0 .02.01.03.03.04l.1.2v.02c.1.16.2.38.3.68a1 1 0 0 1 .04.25 3.2 3.2 0 0 1 .02 1.33 3.49 3.49 0 0 1-.95 1.87l-.66.67-.97.97-1.56 1.57a3.4 3.4 0 0 1-2.47 1.02c-.97 0-1.8-.34-2.49-1.03l-1.3-1.3a3.55 3.55 0 0 1-1-2.51v-.01h-.02v.02zm5.39-3.43c0-.19.02-.4.07-.63.13-.74.44-1.37.95-1.87l.66-.67.97-.98 1.56-1.56c.68-.69 1.5-1.03 2.47-1.03.97 0 1.8.34 2.48 1.02l1.3 1.32a3.48 3.48 0 0 1 1 2.48c0 .58-.11 1.11-.37 1.6l-.02.02v.02l-.02.04c-.14.27-.35.54-.6.8L16.23 15l-.01.02-.01.02c-.44.42-.92.7-1.43.83a4.55 4.55 0 0 0 1.23-3.52L18 10.38c.18-.21.3-.42.35-.65a2.03 2.03 0 0 0-.01-.9 1.96 1.96 0 0 0-.36-.58l-1.3-1.3a1.49 1.49 0 0 0-1.06-.42c-.42 0-.77.14-1.06.4l-1.2 1.27-.8.8-1.16 1.15c-.08.08-.18.21-.29.4a1.66 1.66 0 0 0-.08 1.12l.02.03v.02l.06.14s.01.03.05.06l.06.13.02.02.01.02.01.02c.05.08.1.13.14.16l.47.5c0 .04-.02.09-.04.15l-.06.12-1.15 1.15-.1.08-.56-.56a2.3 2.3 0 0 0-.18-.19c-.02-.01-.02-.03-.02-.04l-.02-.02a.37.37 0 0 1-.1-.12c-.03-.03-.05-.04-.05-.06l-.1-.15-.02-.02-.02-.04-.08-.17v-.02a5.1 5.1 0 0 1-.28-.69 1.03 1.03 0 0 1-.04-.26c-.06-.23-.1-.46-.1-.7v.01z" fill="#A8A8A8"></path></svg></span></button></div></div></div></div></header><span class="l"></span><section><div><div class="gh as hx hy hz ia"></div><div class="ib ic id ie if"><div class=""><h1 id="a660" class="pw-post-title ig ih ii bn ij ik il im in io ip iq ir is it iu iv iw ix iy iz ja jb jc jd je gj">Configuring Linux auditd for Threat Detection</h1></div><p id="2b40" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large organization. While I had a fair understanding of Linux systems, I found surprisingly little on utilizing auditd for at-scale security monitoring purposes.</p><p id="1615" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The topics I look to cover in this article are</p><ul class=""><li id="ca0a" class="kd ke ii jh b ji jj jm jn jq kf ju kg jy kh kc ki kj kk kl gj">Quick intro to the Linux Audit System</li><li id="9e96" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">Tips when writing audit rules</li><li id="6df0" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">Designing a configuration for security monitoring</li><li id="f2b4" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">What to record with auditd</li><li id="3a92" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">Tips on managing noise</li></ul><p id="3165" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The end audience for this article is the security practitioners, IR, blue teamers who need to define what logs they need in their SIEM to detect bad activity. Going forward, I’m hoping things will get a lot easier with ePBF but we’ve never been good at completely eradicating older technologies now have we? :)</p><p id="1309" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">There may be better ways to configure and utilize auditd, so feel free to share your experiences and I’d be happy to incorporate them here.</p></div><div class="o dz kr ks hn kt" role="separator"><span class="ku ge cj kv kw kx"></span><span class="ku ge cj kv kw kx"></span><span class="ku ge cj kv kw"></span></div><div class="ib ic id ie if"><h1 id="f7be" class="ky kz ii bn la lb lc ld le lf lg lh li lj lk ll lm ln lo lp lq lr ls lt lu lv gj"><strong class="ba">The Linux Audit System</strong></h1><p id="1ae5" class="pw-post-body-paragraph jf jg ii jh b ji lw jk jl jm lx jo jp jq ly js jt ju lz jw jx jy ma ka kb kc ib gj">The Linux Audit system provides a way to log events that happen on a Linux system. The recording options offered by the Audit system is extensive — process, network, file, user login/logout events, etc. In this series, I only focus on the security-relevant events from a detection standpoint. The entire list of types that can be recorded are listed <a class="au mb" href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types" rel="noopener ugc nofollow" target="_blank">here</a>. This list will come handy when analyzing logs.</p><p id="613e" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">By default, the packages required to use the Linux audit system are installed on many common distros. I won’t be covering the installation part here. “auditd” is the <strong class="jh ij">audit d</strong>aemon that leverages the Linux audit system to write events to the disk. User-space applications make system calls which the kernel passes through certain filters and then finally through the “exclude” filter. The filters are important when it comes to writing auditd rules. I really like the diagram from <a class="au mb" href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing#sec-audit_system_architecture" rel="noopener ugc nofollow" target="_blank">Red Hat</a> explaining it.</p><figure class="md me mf mg ga mh fo fp paragraph-image"><div class="fo fp mc"><img alt="" class="cf mi mj" src="https://miro.medium.com/max/1320/0*cpEg2_eJmcCq1CZW.png" width="660" height="360" loading="lazy" role="presentation"/></div><figcaption class="mk bm fq fo fp ml mm bn b bo bp co">Audit System Architecture (source: RedHat)</figcaption></figure><p id="2fa1" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">By default, log files are written to /var/log/audit/audit.log. You may find multiple audit.log files in the above directory all of particular max length.</p><p id="8786" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The two files we particularly care about in the audit system are</p><ul class=""><li id="4672" class="kd ke ii jh b ji jj jm jn jq kf ju kg jy kh kc ki kj kk kl gj">audit.rules: Tells the audit daemon what to record. This is where most of one’s time should go — deciding what events are most important to you</li><li id="953c" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">audit.conf: Governs how the audit daemon runs. Log file location, buffer size, log rotation criteria, etc. I would not mess around too much with this file, but we’ll get to some important parameters of it later</li></ul><p id="08d3" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The above was just a brief intro. There are better explanations of the Audit subsystem out there. The link to RedHat’s docs I mentioned above is a good one. Other good documents I can recommend are — <a class="au mb" href="https://documentation.suse.com/sles/12-SP4/html/SLES-all/cha-audit-comp.html" rel="noopener ugc nofollow" target="_blank">Understanding Linux Audit from Suse</a>, <a class="au mb" href="https://github.com/linux-audit/audit-documentation/wiki" rel="noopener ugc nofollow" target="_blank">The Linux Audit Documentation Project</a></p><h1 id="4555" class="ky kz ii bn la lb mn ld le lf mo lh li lj mp ll lm ln mq lp lq lr mr lt lu lv gj"><strong class="ba">Writing Audit rules</strong></h1><p id="e357" class="pw-post-body-paragraph jf jg ii jh b ji lw jk jl jm lx jo jp jq ly js jt ju lz jw jx jy ma ka kb kc ib gj">What you specify in the audit.rules file is what finally lands up in the audit.log. When the audit daemon (auditd) is started (ensure that’s on system startup), rules defined in this file is what gives you events in the audit.log.</p><p id="51d1" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The audit.rules file is located in /etc/audit/audit.rules. This is the final file that auditd refers when writing events to disk. Why I mention this is because, as mentioned at the top of the etc/audit/audit.rules file,</p><blockquote class="ms mt mu"><p id="86b2" class="jf jg mv jh b ji jj jk jl jm jn jo jp mw jr js jt mx jv jw jx my jz ka kb kc ib gj">## This file is automatically generated from /etc/audit/rules.d</p></blockquote><p id="d6c4" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">That doesn’t mean you can’t add to it manually. However, in a large environment, you may have different rule files managed by different parties, that need to run together. You can place these different *.rules files within the /etc/audit/rules.d/ directory. A utility named <em class="mv">augenrules </em>does the job of compiling the different *.rules files (in natural sort order) into the final /etc/audit/audit.rules . It’s worth mentioning that augenrules strips away comments and empty lines before generating audit.rules. I’m mentioning this as I’ve been accused of ridiculous things on this point by nutjobs in the past.</p><p id="6442" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Coming to the rule writing. Let’s focus on the 2 types of rules that we’re interested in configuring</p><ul class=""><li id="fc3a" class="kd ke ii jh b ji jj jm jn jq kf ju kg jy kh kc ki kj kk kl gj">File watches — can watch read, write, execute or attribute changes</li><li id="ce08" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">Syscalls — record syscalls sent to the kernel by the application</li></ul><p id="0c4c" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">I’m not going to go into the depths of writing auditd rules, I recommend reading the <a class="au mb" href="https://linux.die.net/man/7/audit.rules" rel="noopener ugc nofollow" target="_blank">man page</a> for that.</p><p id="feb5" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Some good references to look into when writing rules</p><ul class=""><li id="c425" class="kd ke ii jh b ji jj jm jn jq kf ju kg jy kh kc ki kj kk kl gj">Inbuilt examples — <a class="au mb" href="https://github.com/linux-audit/audit-userspace/tree/master/rules" rel="noopener ugc nofollow" target="_blank">https://github.com/linux-audit/audit-userspace/tree/master/rules</a></li><li id="e8fe" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">MITRE-based rules — <a class="au mb" href="https://github.com/bfuzzy1/auditd-attack/tree/master/auditd-attack" rel="noopener ugc nofollow" target="_blank">https://github.com/bfuzzy1/auditd-attack/tree/master/auditd-attack</a></li><li id="30c7" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">Florian Roth’s best practice ruleset — <a class="au mb" href="https://github.com/Neo23x0/auditd" rel="noopener ugc nofollow" target="_blank">https://github.com/Neo23x0/auditd</a></li><li id="2e1b" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj"><a class="au mb" href="https://slack.engineering/syscall-auditing-at-scale/" rel="noopener ugc nofollow" target="_blank">https://slack.engineering/syscall-auditing-at-scale/</a></li></ul><p id="cb95" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">A few notes to keep in mind when building rules</p><ul class=""><li id="f373" class="kd ke ii jh b ji jj jm jn jq kf ju kg jy kh kc ki kj kk kl gj">Utilize tagging — audit rules allow for tagging (-k) which is very helpful when analyzing events later. You could use your own custom tags or even tag rules with MITRE IDs (see bfuzzy1’s link above)</li><li id="c508" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">When monitoring syscalls, it’s often better to monitor the syscall upon exit rather than entry (-always,exit). Important parameters may not be available at the time of function entry because they aren’t defined yet, hence you miss it too</li><li id="4a3e" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">When doing syscall auditing always try to combine rules where you can (-a always,exit -S rmdir -S unlink -S rename). Each syscall rule gets evaluated for every syscall every program makes. It adds up, thereby impacting performance</li><li id="1c8a" class="kd ke ii jh b ji km jm kn jq ko ju kp jy kq kc ki kj kk kl gj">When writing rules, you may come across a filter criteria ‘-F auid!=4294967295’. This number is the equivalent of 0xFFFFFFFF which is the highest unsigned int number. It evaluates to -1 which in auditd world is equivalent to “unset”, i.e, it’s not defined yet. It’s common for this to happen with processes that initialize before the audit daemon. As in the audit.rules <a class="au mb" href="https://man7.org/linux/man-pages/man7/audit.rules.7.html" rel="noopener ugc nofollow" target="_blank">man page</a> —</li></ul><blockquote class="ms mt mu"><p id="1c7e" class="jf jg mv jh b ji jj jk jl jm jn jo jp mw jr js jt mx jv jw jx my jz ka kb kc ib gj">“The audit system considers uids to be unsigned numbers. The audit<br/> system uses the number -1 to indicate that a loginuid is not set.<br/> This means that when it’s printed out, it looks like 4294967295.<br/> But when you write rules, you can use either “unset” which is<br/> easy to remember, or -1, or 4294967295. They are all equivalent.”</p></blockquote><ul class=""><li id="0f3f" class="kd ke ii jh b ji jj jm jn jq kf ju kg jy kh kc ki kj kk kl gj">A note on exclusions — ensure your exclusions (-a never,exclude) are specific and placed on top so they get matched first. There are debates on whether specific includes or excludes should go on top. Specific includes would be the best for performance but I don’t find this a feasible option for large environments. Often times, the syscalls (like execve) are where you gain maximum visibility from a security detection perspective. Were you to place them right on top, you’d have little scope for performance tuning thereafter.</li></ul><p id="e7b0" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj"><strong class="jh ij">Configuration of the Audit Daemon</strong></p><p id="66b1" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">There are two places you can specify configurations for the audit daemon. One place is directly at the top of the audit.rules file as control rules and the other is in the audit.conf file. The configurations you can modify in both these places differ. Unless for a specific reason, I would not toy with the configurations of auditd except for a few</p><p id="6aab" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Backlog size: This can be set by using the -b keyword followed by the number of audit messages to buffer. The backlog option limits the number of messages that can be queued up waiting to be written to the log. Here, it’s recommended you start with the default and work your way up. On production level systems, I’ve seen 8192 as a feasible option. When the limit is breached, you should see a “backlog limit exceeded” in the logs and that can be your indicator to increase this buffer. Keep in mind, the higher buffer value, the more memory consumption on the system</p><p id="5a00" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Failure flag: Set with -f, it instructs auditd what to do when the above buffer is full. In production systems, you definitely don’t want disruption hence I recommend setting this to 1 so it prints in the log and nothing else</p><p id="ea97" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Enabled flag: Set with -e, can help ensure your audit configuration is not modified, i.e, immutable. Setting it to 2 will ensure that any changes will be denied and logged. Only a restart of the system can change the configuration. Remember, ensure this rule is the last rule in your ruleset.</p><p id="4af3" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">These are all the configuration files I’d recommend modifying. The audit.conf file you can have a look into but normally, I wouldn’t change too much there. Depending upon your environment and if you want the auditd daemon to deal with, for example, what to do when the log file is full, the audit.conf file may be worth looking into. Normally, the default value have worked for me.</p></div><div class="o dz kr ks hn kt" role="separator"><span class="ku ge cj kv kw kx"></span><span class="ku ge cj kv kw kx"></span><span class="ku ge cj kv kw"></span></div><div class="ib ic id ie if"><h1 id="9800" class="ky kz ii bn la lb lc ld le lf lg lh li lj lk ll lm ln lo lp lq lr ls lt lu lv gj">What to record?</h1><p id="f749" class="pw-post-body-paragraph jf jg ii jh b ji lw jk jl jm lx jo jp jq ly js jt ju lz jw jx jy ma ka kb kc ib gj">The Linux audit subsystem allows us to record a lot of information. The question I look to provide some clarity to is — what’s worth recording and what isn’t?</p><p id="0da9" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">First, let’s have a look at the most relevant data sources from MITRE.</p><figure class="md me mf mg ga mh fo fp paragraph-image"><div role="button" tabindex="0" class="na nb dq nc cf nd"><div class="fo fp mz"><img alt="" class="cf mi mj" src="https://miro.medium.com/max/1400/0*pca21Ou66pIzFx-6.jpg" width="700" height="402" loading="lazy" role="presentation"/></div></div><figcaption class="mk bm fq fo fp ml mm bn b bo bp co">Source: <a class="au mb" href="https://github.com/mitre-attack/attack-datasources" rel="noopener ugc nofollow" target="_blank">https://github.com/mitre-attack/attack-datasources</a></figcaption></figure><p id="46ba" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The above graph is based on <a class="au mb" href="https://attack.mitre.org/matrices/enterprise/" rel="noopener ugc nofollow" target="_blank">Mitre’s ATT&amp;CK Enterprise framework</a> and the data source that is associated by different sub-techniques in the framework. As we can see, majority of the techniques are detectable by command execution and process creation events. Reason being, these normally contain the command line executed.</p><p id="d9db" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Coming back to auditd, majority of these data sources can be monitored by auditd (at a price of course). Here’s my shot at correlating the above list with auditd record types that give us this information.</p><figure class="md me mf mg ga mh fo fp paragraph-image"><div role="button" tabindex="0" class="na nb dq nc cf nd"><div class="fo fp ne"><img alt="" class="cf mi mj" src="https://miro.medium.com/max/1400/1*PRHwxsfyvAXu3PXvP2rAMA.png" width="700" height="176" loading="lazy" role="presentation"/></div></div><figcaption class="mk bm fq fo fp ml mm bn b bo bp co">Data Source to Audit Rule Mapping</figcaption></figure><p id="9841" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Because Medium is a bitch with formatting, the above is an image. I’ve also uploaded the same here: <a class="au mb" href="https://github.com/izysec/linux-audit/blob/main/DS-to-audit.MD" rel="noopener ugc nofollow" target="_blank">https://github.com/izysec/linux-audit/blob/main/DS-to-audit.MD</a></p><p id="665b" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The above list is just to help you prioritize your rule writing better. Auditd in general is going to be noisy and it’d be wise to assume performance of production systems running a security-centric auditd configuration to have an impact of at least 10–15%.</p><p id="efc2" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Because auditd has so many different record types, monitoring all of them may not feasible. I’ve found that, aside from being strict with the rules you write, excluding message types can also be a nice way to trim down noise. Here are some message types I think are worth monitoring from a security perspective</p><figure class="md me mf mg ga mh fo fp paragraph-image"><div role="button" tabindex="0" class="na nb dq nc cf nd"><div class="fo fp nf"><img alt="" class="cf mi mj" src="https://miro.medium.com/max/1400/1*piomhp5PUprBgTObXUbwfw.png" width="700" height="547" loading="lazy" role="presentation"/></div></div></figure><p id="69aa" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">When writing your audit.rules, it makes sense to explicitly specify which record types are not to be recorded. We’ve found this as a good way to reduce noise from auditd. You can do so using rules like the following</p><p id="7a0b" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj"><em class="mv">-a never,exclude -F msgtype=ANOM_ACCESS_FS</em></p><p id="bc5b" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">As mentioned before, each line gets evaluated so here you can, compound rules will help your performance. You can find a one-liner audit rule excluding all other audit record types than the ones in the above table on my Github here: <a class="au mb" href="https://github.com/izysec/linux-audit/blob/main/exclude-records.rules" rel="noopener ugc nofollow" target="_blank">https://github.com/izysec/linux-audit/blob/main/exclude-records.rules</a></p><p id="5553" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">Additionally, you can find the entire list of record types <a class="au mb" href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types" rel="noopener ugc nofollow" target="_blank">here</a>. The list of main and auxiliary record types can also be found directly <a class="au mb" href="https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/audit.h#L89" rel="noopener ugc nofollow" target="_blank">in the code</a>.</p><p id="db6c" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">An event on a Linux system may trigger multiple auditd events. There is one primary event followed by auxiliary events of different record types. These auxiliary events have supporting information for the event. The number of auxiliary records an event may have depends upon the path a syscall takes through the kernel and where auditd is designed to hook into it. At the moment, there’s no mapping table between syscall and record types generated that I know of. An example of an auxiliary record would be the record type CWD which you will see many times in the audit.log. CWD records gives you the current working directory from the main event took place. But you don’t see it on the list above. Reason being, while it can be useful to know this in some cases, it’s also not the most critical piece of information when you’re trying to detect bad activity and you can make some good guesses based on the other data you have. We’re trying to even out security vs. feasibility and in doing so, you can’t have absolutely everything.</p></div><div class="o dz kr ks hn kt" role="separator"><span class="ku ge cj kv kw kx"></span><span class="ku ge cj kv kw kx"></span><span class="ku ge cj kv kw"></span></div><div class="ib ic id ie if"><h1 id="bce8" class="ky kz ii bn la lb lc ld le lf lg lh li lj lk ll lm ln lo lp lq lr ls lt lu lv gj">Closing Notes</h1><p id="ba46" class="pw-post-body-paragraph jf jg ii jh b ji lw jk jl jm lx jo jp jq ly js jt ju lz jw jx jy ma ka kb kc ib gj">I believe auditd can indeed be used as a means for detecting threats on Linux endpoints, even in large environments. Throwing in a pre-configured rule set from the internet will give you issues however. Knowing exactly what you want to monitor and eliminating noisy events using methods described in this post, will help you arrive at a configuration suitable for even large, complex environments.</p><p id="b10d" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">The approach I would take is this — monitor your syscalls of interest (execve, connect) right on top followed by the files/directories of importance and then finally simpler rules to look for monitoring specific binaries like nmap, tshark, etc. if that’s important to you.</p><p id="678b" class="pw-post-body-paragraph jf jg ii jh b ji jj jk jl jm jn jo jp jq jr js jt ju jv jw jx jy jz ka kb kc ib gj">I plan to write another blog dedicated to tips to better analyze audit logs as well as share sample log snippets of different activity types so you know what they look like in the logs. Not sure when I’ll get around to doing this, depends on how useful this one is to begin with. Thanks for making it this far :)</p></div></div></section></div></div></article><div class="ng o"></div></div></div><div></div><div class="dc nh o dz ni nj"><div class="nk eb nl nm nn o ao c"><div class="o ao gl"><div class="pw-multi-vote-icon dq no np nq nr"><div class=""><div class="dt ns dg nt nu nv nw bb nx ny nz nr"><svg width="24" height="24" viewBox="0 0 24 24" aria-label="clap"><path fill-rule="evenodd" clip-rule="evenodd" d="M11.37.83L12 3.28l.63-2.45h-1.26zM15.42 1.84l-1.18-.39-.34 2.5 1.52-2.1zM9.76 1.45l-1.19.4 1.53 2.1-.34-2.5zM20.25 11.84l-2.5-4.4a1.42 1.42 0 0 0-.93-.64.96.96 0 0 0-.75.18c-.25.19-.4.42-.45.7l.05.05 2.35 4.13c1.62 2.95 1.1 5.78-1.52 8.4l-.46.41c1-.13 1.93-.6 2.78-1.45 2.7-2.7 2.51-5.59 1.43-7.38zM12.07 9.01c-.13-.69.08-1.3.57-1.77l-2.06-2.07a1.12 1.12 0 0 0-1.56 0c-.15.15-.22.34-.27.53L12.07 9z"></path><path fill-rule="evenodd" clip-rule="evenodd" d="M14.74 8.3a1.13 1.13 0 0 0-.73-.5.67.67 0 0 0-.53.13c-.15.12-.59.46-.2 1.3l1.18 2.5a.45.45 0 0 1-.23.76.44.44 0 0 1-.48-.25L7.6 6.11a.82.82 0 1 0-1.15 1.15l3.64 3.64a.45.45 0 1 1-.63.63L5.83 7.9 4.8 6.86a.82.82 0 0 0-1.33.9c.04.1.1.18.18.26l1.02 1.03 3.65 3.64a.44.44 0 0 1-.15.73.44.44 0 0 1-.48-.1L4.05 9.68a.82.82 0 0 0-1.4.57.81.81 0 0 0 .24.58l1.53 1.54 2.3 2.28a.45.45 0 0 1-.64.63L3.8 13a.81.81 0 0 0-1.39.57c0 .22.09.43.24.58l4.4 4.4c2.8 2.8 5.5 4.12 8.68.94 2.27-2.28 2.71-4.6 1.34-7.1l-2.32-4.08z"></path></svg></div></div></div><div class="pw-multi-vote-count l oa ob oc od oe of og"><p class="bn b gr bp co"><span class="ns">--</span></p></div></div><div class="oh oi oj l"></div><div><div class="cj" aria-hidden="false"><button class="ok dt ol o ao dg om on" aria-label="responses"><svg width="24" height="24" viewBox="0 0 24 24" aria-label="responses" class=""><path d="M18 16.8a7.14 7.14 0 0 0 2.24-5.32c0-4.12-3.53-7.48-8.05-7.48C7.67 4 4 7.36 4 11.48c0 4.13 3.67 7.48 8.2 7.48a8.9 8.9 0 0 0 2.38-.32c.23.2.48.39.75.56 1.06.69 2.2 1.04 3.4 1.04.22 0 .4-.11.48-.29a.5.5 0 0 0-.04-.52 6.4 6.4 0 0 1-1.16-2.65v.02zm-3.12 1.06l-.06-.22-.32.1a8 8 0 0 1-2.3.33c-4.03 0-7.3-2.96-7.3-6.59S8.17 4.9 12.2 4.9c4 0 7.1 2.96 7.1 6.6 0 1.8-.6 3.47-2.02 4.72l-.2.16v.26l.02.3a6.74 6.74 0 0 0 .88 2.4 5.27 5.27 0 0 1-2.17-.86c-.28-.17-.72-.38-.94-.59l.01-.02z"></path></svg></button></div></div></div></div><div class="l"></div><footer class="oo op oq or o ao os dd c"><div class="l ot"><div class="o dz"><div class="eo cf fa fb fc fd fe ff fg fh fi"><div class="o u ou"><div class="o ao gl"><div class="ov l"><span class="l gn ow ox e d"><div class="o ao gl"><div class="pw-multi-vote-icon dq no np nq nr"><div class=""><div class="dt ns dg nt nu nv nw bb nx ny nz nr"><svg width="24" height="24" viewBox="0 0 24 24" aria-label="clap"><path fill-rule="evenodd" clip-rule="evenodd" d="M11.37.83L12 3.28l.63-2.45h-1.26zM15.42 1.84l-1.18-.39-.34 2.5 1.52-2.1zM9.76 1.45l-1.19.4 1.53 2.1-.34-2.5zM20.25 11.84l-2.5-4.4a1.42 1.42 0 0 0-.93-.64.96.96 0 0 0-.75.18c-.25.19-.4.42-.45.7l.05.05 2.35 4.13c1.62 2.95 1.1 5.78-1.52 8.4l-.46.41c1-.13 1.93-.6 2.78-1.45 2.7-2.7 2.51-5.59 1.43-7.38zM12.07 9.01c-.13-.69.08-1.3.57-1.77l-2.06-2.07a1.12 1.12 0 0 0-1.56 0c-.15.15-.22.34-.27.53L12.07 9z"></path><path fill-rule="evenodd" clip-rule="evenodd" d="M14.74 8.3a1.13 1.13 0 0 0-.73-.5.67.67 0 0 0-.53.13c-.15.12-.59.46-.2 1.3l1.18 2.5a.45.45 0 0 1-.23.76.44.44 0 0 1-.48-.25L7.6 6.11a.82.82 0 1 0-1.15 1.15l3.64 3.64a.45.45 0 1 1-.63.63L5.83 7.9 4.8 6.86a.82.82 0 0 0-1.33.9c.04.1.1.18.18.26l1.02 1.03 3.65 3.64a.44.44 0 0 1-.15.73.44.44 0 0 1-.48-.1L4.05 9.68a.82.82 0 0 0-1.4.57.81.81 0 0 0 .24.58l1.53 1.54 2.3 2.28a.45.45 0 0 1-.64.63L3.8 13a.81.81 0 0 0-1.39.57c0 .22.09.43.24.58l4.4 4.4c2.8 2.8 5.5 4.12 8.68.94 2.27-2.28 2.71-4.6 1.34-7.1l-2.32-4.08z"></path></svg></div></div></div><div class="pw-multi-vote-count l oa ob oc od oe of og"><p class="bn b gr bp co"><span class="ns">--</span></p></div></div></span><span class="l h g f oy oz"><div class="o ao gl"><div class="pw-multi-vote-icon dq no np nq nr"><div class=""><div class="dt ns dg nt nu nv nw bb nx ny nz nr"><svg width="24" height="24" viewBox="0 0 24 24" aria-label="clap"><path fill-rule="evenodd" clip-rule="evenodd" d="M11.37.83L12 3.28l.63-2.45h-1.26zM15.42 1.84l-1.18-.39-.34 2.5 1.52-2.1zM9.76 1.45l-1.19.4 1.53 2.1-.34-2.5zM20.25 11.84l-2.5-4.4a1.42 1.42 0 0 0-.93-.64.96.96 0 0 0-.75.18c-.25.19-.4.42-.45.7l.05.05 2.35 4.13c1.62 2.95 1.1 5.78-1.52 8.4l-.46.41c1-.13 1.93-.6 2.78-1.45 2.7-2.7 2.51-5.59 1.43-7.38zM12.07 9.01c-.13-.69.08-1.3.57-1.77l-2.06-2.07a1.12 1.12 0 0 0-1.56 0c-.15.15-.22.34-.27.53L12.07 9z"></path><path fill-rule="evenodd" clip-rule="evenodd" d="M14.74 8.3a1.13 1.13 0 0 0-.73-.5.67.67 0 0 0-.53.13c-.15.12-.59.46-.2 1.3l1.18 2.5a.45.45 0 0 1-.23.76.44.44 0 0 1-.48-.25L7.6 6.11a.82.82 0 1 0-1.15 1.15l3.64 3.64a.45.45 0 1 1-.63.63L5.83 7.9 4.8 6.86a.82.82 0 0 0-1.33.9c.04.1.1.18.18.26l1.02 1.03 3.65 3.64a.44.44 0 0 1-.15.73.44.44 0 0 1-.48-.1L4.05 9.68a.82.82 0 0 0-1.4.57.81.81 0 0 0 .24.58l1.53 1.54 2.3 2.28a.45.45 0 0 1-.64.63L3.8 13a.81.81 0 0 0-1.39.57c0 .22.09.43.24.58l4.4 4.4c2.8 2.8 5.5 4.12 8.68.94 2.27-2.28 2.71-4.6 1.34-7.1l-2.32-4.08z"></path></svg></div></div></div><div class="pw-multi-vote-count l oa ob oc od oe of og"><p class="bn b gr bp co"><span class="ns">--</span></p></div></div></span></div><div class="pa o"><div><div class="cj" aria-hidden="false"><button class="ok dt ol o ao dg om on" aria-label="responses"><svg width="24" height="24" viewBox="0 0 24 24" aria-label="responses" class="pb"><path d="M18 16.8a7.14 7.14 0 0 0 2.24-5.32c0-4.12-3.53-7.48-8.05-7.48C7.67 4 4 7.36 4 11.48c0 4.13 3.67 7.48 8.2 7.48a8.9 8.9 0 0 0 2.38-.32c.23.2.48.39.75.56 1.06.69 2.2 1.04 3.4 1.04.22 0 .4-.11.48-.29a.5.5 0 0 0-.04-.52 6.4 6.4 0 0 1-1.16-2.65v.02zm-3.12 1.06l-.06-.22-.32.1a8 8 0 0 1-2.3.33c-4.03 0-7.3-2.96-7.3-6.59S8.17 4.9 12.2 4.9c4 0 7.1 2.96 7.1 6.6 0 1.8-.6 3.47-2.02 4.72l-.2.16v.26l.02.3a6.74 6.74 0 0 0 .88 2.4 5.27 5.27 0 0 1-2.17-.86c-.28-.17-.72-.38-.94-.59l.01-.02z"></path></svg></button></div></div></div></div><div class="o ao"><div class="cj" aria-hidden="false" aria-describedby="postFooterSocialMenu" aria-labelledby="postFooterSocialMenu"><div><div class="cj" aria-hidden="false"><button class="au av aw ax ay az ba hj bc bd be bf bg bh bi pc hk pd" aria-controls="postFooterSocialMenu" aria-expanded="false" aria-label="Share Post"><svg width="24" height="24" viewBox="0 0 24 24" fill="none"><path fill-rule="evenodd" clip-rule="evenodd" d="M15.22 4.93a.42.42 0 0 1-.12.13h.01a.45.45 0 0 1-.29.08.52.52 0 0 1-.3-.13L12.5 3v7.07a.5.5 0 0 1-.5.5.5.5 0 0 1-.5-.5V3.02l-2 2a.45.45 0 0 1-.57.04h-.02a.4.4 0 0 1-.16-.3.4.4 0 0 1 .1-.32l2.8-2.8a.5.5 0 0 1 .7 0l2.8 2.8a.42.42 0 0 1 .07.5zm-.1.14zm.88 2h1.5a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2h-11a2 2 0 0 1-2-2v-10a2 2 0 0 1 2-2H8a.5.5 0 0 1 .35.14c.1.1.15.22.15.35a.5.5 0 0 1-.15.35.5.5 0 0 1-.35.15H6.4c-.5 0-.9.4-.9.9v10.2a.9.9 0 0 0 .9.9h11.2c.5 0 .9-.4.9-.9V8.96c0-.5-.4-.9-.9-.9H16a.5.5 0 0 1 0-1z" fill="#000"></path></svg></button></div></div></div><div class="pe l hi"></div></div></div></div></div></div></footer></div><div class="o dz"><div class="eo cf fa fb fc fd fe ff fg fh fi"></div></div><div class="l"><div class="l pf ou"><div class="l ou"><div class="pg ph l pf"><div class="o dz"><div class="eo cf fa fb fc fd fe ff fg fh fi"><div class="o ao u"><h2 class="bn pi pj pk pl le pm pn po li jq pp pq lm ju pr ps lq jy pt pu lu pv pw px py pz qa qb gj"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" rel="noopener follow" href="/?source=post_page-----d06c8b941505--------------------------------">More from IzyKnows</a></h2><div class="qc o"><span><button class="bn b bo bp gs br gu gv gw gx gy bd ca gz ha hb ce cg ch ci cj ck">Follow</button></span><div class="qc l"><div><div><div class="cj" aria-hidden="false"><div class="l"><span><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/m/signin?actionUrl=%2F_%2Fapi%2Fsubscriptions%2Fnewsletters%2Ffdbac678d578&amp;operation=register&amp;redirect=https%3A%2F%2Fizyknows.medium.com%2Flinux-auditd-for-threat-detection-d06c8b941505&amp;newsletterV3=fd25d228e7cd&amp;newsletterV3Id=fdbac678d578&amp;user=IzyKnows&amp;userId=fd25d228e7cd&amp;source=-----d06c8b941505---------------------subscribe_user-----------" rel="noopener follow"><button class="bn b bo bp bq bb bs bt bu bv bw bx by bz ca gz ha hb ce cg ch ci cj ck" aria-label="Subscribe"><svg width="38" height="38" viewBox="0 0 38 38" fill="none" class="qd qe qf"><rect x="26.25" y="9.25" width="0.5" height="6.5" rx="0.25"></rect><rect x="29.75" y="12.25" width="0.5" height="6.5" rx="0.25" transform="rotate(90 29.75 12.25)"></rect><path d="M19.5 12.5h-7a1 1 0 0 0-1 1v11a1 1 0 0 0 1 1h13a1 1 0 0 0 1-1v-5"></path><path d="M11.5 14.5L19 20l4-3"></path></svg></button></a></span></div></div></div></div></div></div></div><div class="qg l"><p class="bn b bo bp co">I like to break things :)</p></div></div></div></div></div><div class="qh l"><div class="qi qj qk ql l"><div class="ht l bm"><div class="o dz"><div class="qm qn qo qp qq mi eo cf"><div class="ah qr ai qs gp qt gq qu oz qv"><p class="bn b do dp gj">Love podcasts or audiobooks? Learn on the go with our new app.</p></div><div class="qw ah qx ai qy gp qz gq ra oz"><a class="bn b bo bp gs br gu rb rc rd re bd ca cb cc cd ce cg ch ci cj ck" href="https://knowable.fyi/?utm_source=medium&amp;utm_medium=referral&amp;utm_campaign=medium-post-footer&amp;source=post_page-----d06c8b941505--------------------------------" rel="noopener follow">Try Knowable</a></div></div></div></div></div></div><div class="o dz"><div class="eo cf fa fb fc fd fe ff fg fh fi"><div class="rf qk l"><section class="pw-more-medium-articles l"><div class="rg l"><h2 class="bn pi pj pk pl le pm pn po li jq pp pq lm ju pr ps lq jy pt pu lu pv pw px py pz qa qb gj">Recommended from Medium</h2></div><div class="gb o gl hc rh ri rj rk rl rm rn ro rp rq rr rs rt ru rv"><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://medium.com/@gulshan.bajaj/how-to-iterate-without-any-loop-c956b2897e1b?source=post_internal_links---------0----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@gulshan.bajaj?source=post_internal_links---------0----------------------------" rel="noopener follow"><div class="l dq"><img alt="Gulshan Bajaj" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*dmbNkD5D-u45r44go_cf0g.png" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@gulshan.bajaj?source=post_internal_links---------0----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Gulshan Bajaj</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>How to Iterate without any loop</div></h2></div><div class="tc l"></div></div></div></a></div></div></div><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://zhaofeng8711.medium.com/python-100-projects-in-100-days-learning-journal-979d9500c868?source=post_internal_links---------1----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://zhaofeng8711.medium.com/?source=post_internal_links---------1----------------------------" rel="noopener follow"><div class="l dq"><img alt="Paul Zhao" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/2*RgF17eEzwxkckQIZ89gSIw.png" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://zhaofeng8711.medium.com/?source=post_internal_links---------1----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Paul Zhao</p></a></div></div></div></div><div class="hh l"><p class="bn b gr bp co">in</p></div><div class="l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/paul-zhao-projects?source=post_internal_links---------1----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Paul Zhao Projects</p></a></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Python 100 projects in 100 days — Learning Journal</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/0*jotJuyhgAGE-L6GG.png" width="56" role="presentation"/></div></div></div></div></div></a></div></div></div><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://kwpowers.medium.com/2d-character-setup-in-unity-movement-98d159d44fab?source=post_internal_links---------2----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://kwpowers.medium.com/?source=post_internal_links---------2----------------------------" rel="noopener follow"><div class="l dq"><img alt="Kyle W. Powers" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*NQg-Bj1C53ejxqMr3Lbp9Q.jpeg" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://kwpowers.medium.com/?source=post_internal_links---------2----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Kyle W. Powers</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>2D Character Setup in Unity — Movement</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/freeze/focal/112/112/50/50/1*MG4BywFD3TdzK6Ciqt9DOg.gif" width="56" role="presentation"/></div></div></div></div></div></a></div></div></div><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://medium.com/@saronsmith761/django-vs-laravel-web-development-performance-comparison-f8ab46c72fe9?source=post_internal_links---------3----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@saronsmith761?source=post_internal_links---------3----------------------------" rel="noopener follow"><div class="l dq"><img alt="Saronsmith" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*HmCwVXjcMs3z56J37pyZlw.jpeg" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@saronsmith761?source=post_internal_links---------3----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Saronsmith</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Django Vs Laravel Web Development — Performance Comparison</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*JMuijNHsmcSgjnO---g6kg.jpeg" width="56" role="presentation"/></div></div></div></div></div></a></div></div></div><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://qiuyujx.medium.com/do-you-know-python-has-built-in-array-c2afa4200b97?source=post_internal_links---------4----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://qiuyujx.medium.com/?source=post_internal_links---------4----------------------------" rel="noopener follow"><div class="l dq"><img alt="Christopher Tao" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*aL2isee1E3zr8mzSXRiASA.png" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://qiuyujx.medium.com/?source=post_internal_links---------4----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Christopher Tao</p></a></div></div></div></div><div class="hh l"><p class="bn b gr bp co">in</p></div><div class="l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://towardsdatascience.com/?source=post_internal_links---------4----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Towards Data Science</p></a></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Do You Know Python Has Built-In Array?</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*otM8jk-QlanpdfCHh45zpg.jpeg" width="56" role="presentation"/></div></div></div></div></div></a></div></div></div><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://sbanerjee01.medium.com/exactly-once-processing-with-spark-structured-streaming-f2a78f45a76a?source=post_internal_links---------5----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://sbanerjee01.medium.com/?source=post_internal_links---------5----------------------------" rel="noopener follow"><div class="l dq"><img alt="Soumya Banerjee" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*dmbNkD5D-u45r44go_cf0g.png" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://sbanerjee01.medium.com/?source=post_internal_links---------5----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Soumya Banerjee</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>‘Exactly Once’ processing with Spark Structured Streaming</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*bou_9xkI83c9-RY4YUA7fg.png" width="56" role="presentation"/></div></div></div></div></div></a></div></div></div><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://paulgrajewski.medium.com/installation-python-package-pillow-on-windows-bf6339926bc9?source=post_internal_links---------6----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://paulgrajewski.medium.com/?source=post_internal_links---------6----------------------------" rel="noopener follow"><div class="l dq"><img alt="Pawel Grajewski" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*vB8y5DvdiwH0UDLvI6Jchg.png" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://paulgrajewski.medium.com/?source=post_internal_links---------6----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Pawel Grajewski</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Installation python package Pillow on Windows</div></h2></div><div class="tc l"></div></div></div></a></div></div></div><div class="rw rx ry rz sa sb sc sd se sf sg sh si sj sk sl sm sn so sp sq"><div class="cf ag"><div class="sr l"><a href="https://medium.com/@anovotny_12970/get-started-with-the-box-cli-in-less-than-five-minutes-3fe2f70f879a?source=post_internal_links---------7----------------------------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@anovotny_12970?source=post_internal_links---------7----------------------------" rel="noopener follow"><div class="l dq"><img alt="Alex Novotny" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*L3-AdWjDbLj1t0a8gfAULg.jpeg" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@anovotny_12970?source=post_internal_links---------7----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Alex Novotny</p></a></div></div></div></div><div class="hh l"><p class="bn b gr bp co">in</p></div><div class="l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/box-developer-blog?source=post_internal_links---------7----------------------------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Box Developer Blog</p></a></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Get started with the Box CLI in less than five minutes!</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*KJ-miRLb-rRRWqDz4m6-yg.png" width="56" role="presentation"/></div></div></div></div></div></a></div></div></div></div></section></div></div></div></div></div><div class="d"><div class="tg th ti l os ar ef as tj tk"><div class="o dz"><div class="fa fb tl tm tn to eo cf"><a class="au av aw ax ay az ba bb bc bd tp tq bg tr ts" aria-label="Go to homepage" href="https://medium.com/?source=post_page-----d06c8b941505--------------------------------" rel="noopener follow"><svg viewBox="0 0 3940 610" class="gu tt"><path d="M594.79 308.2c0 163.76-131.85 296.52-294.5 296.52S5.8 472 5.8 308.2 137.65 11.69 300.29 11.69s294.5 132.75 294.5 296.51M917.86 308.2c0 154.16-65.93 279.12-147.25 279.12s-147.25-125-147.25-279.12S689.29 29.08 770.61 29.08s147.25 125 147.25 279.12M1050 308.2c0 138.12-23.19 250.08-51.79 250.08s-51.79-112-51.79-250.08 23.19-250.08 51.8-250.08S1050 170.09 1050 308.2M1862.77 37.4l.82-.18v-6.35h-167.48l-155.51 365.5-155.51-365.5h-180.48v6.35l.81.18c30.57 6.9 46.09 17.19 46.09 54.3v434.45c0 37.11-15.58 47.4-46.15 54.3l-.81.18V587H1327v-6.35l-.81-.18c-30.57-6.9-46.09-17.19-46.09-54.3V116.9L1479.87 587h11.33l205.59-483.21V536.9c-2.62 29.31-18 38.36-45.68 44.61l-.82.19v6.3h213.3v-6.3l-.82-.19c-27.71-6.25-43.46-15.3-46.08-44.61l-.14-445.2h.14c0-37.11 15.52-47.4 46.08-54.3m97.43 287.8c3.49-78.06 31.52-134.4 78.56-135.37 14.51.24 26.68 5 36.14 14.16 20.1 19.51 29.55 60.28 28.09 121.21zm-2.11 22h250v-1.05c-.71-59.69-18-106.12-51.34-138-28.82-27.55-71.49-42.71-116.31-42.71h-1c-23.26 0-51.79 5.64-72.09 15.86-23.11 10.7-43.49 26.7-60.45 47.7-27.3 33.83-43.84 79.55-47.86 130.93-.13 1.54-.24 3.08-.35 4.62s-.18 2.92-.25 4.39a332.64 332.64 0 0 0-.36 21.69C1860.79 507 1923.65 600 2035.3 600c98 0 155.07-71.64 169.3-167.8l-7.19-2.53c-25 51.68-69.9 83-121 79.18-69.76-5.22-123.2-75.95-118.35-161.63m532.69 157.68c-8.2 19.45-25.31 30.15-48.24 30.15s-43.89-15.74-58.78-44.34c-16-30.7-24.42-74.1-24.42-125.51 0-107 33.28-176.21 84.79-176.21 21.57 0 38.55 10.7 46.65 29.37zm165.84 76.28c-30.57-7.23-46.09-18-46.09-57V5.28L2424.77 60v6.7l1.14-.09c25.62-2.07 43 1.47 53.09 10.79 7.9 7.3 11.75 18.5 11.75 34.26v71.14c-18.31-11.69-40.09-17.38-66.52-17.38-53.6 0-102.59 22.57-137.92 63.56-36.83 42.72-56.3 101.1-56.3 168.81C2230 518.72 2289.53 600 2378.13 600c51.83 0 93.53-28.4 112.62-76.3V588h166.65v-6.66zm159.29-505.33c0-37.76-28.47-66.24-66.24-66.24-37.59 0-67 29.1-67 66.24s29.44 66.24 67 66.24c37.77 0 66.24-28.48 66.24-66.24m43.84 505.33c-30.57-7.23-46.09-18-46.09-57h-.13V166.65l-166.66 47.85v6.5l1 .09c36.06 3.21 45.93 15.63 45.93 57.77V588h166.8v-6.66zm427.05 0c-30.57-7.23-46.09-18-46.09-57V166.65L3082 212.92v6.52l.94.1c29.48 3.1 38 16.23 38 58.56v226c-9.83 19.45-28.27 31-50.61 31.78-36.23 0-56.18-24.47-56.18-68.9V166.66l-166.66 47.85V221l1 .09c36.06 3.2 45.94 15.62 45.94 57.77v191.27a214.48 214.48 0 0 0 3.47 39.82l3 13.05c14.11 50.56 51.08 77 109 77 49.06 0 92.06-30.37 111-77.89v66h166.66v-6.66zM3934.2 588v-6.67l-.81-.19c-33.17-7.65-46.09-22.07-46.09-51.43v-243.2c0-75.83-42.59-121.09-113.93-121.09-52 0-95.85 30.05-112.73 76.86-13.41-49.6-52-76.86-109.06-76.86-50.12 0-89.4 26.45-106.25 71.13v-69.87l-166.66 45.89v6.54l1 .09c35.63 3.16 45.93 15.94 45.93 57V588h155.5v-6.66l-.82-.2c-26.46-6.22-35-17.56-35-46.66V255.72c7-16.35 21.11-35.72 49-35.72 34.64 0 52.2 24 52.2 71.28V588h155.54v-6.66l-.82-.2c-26.46-6.22-35-17.56-35-46.66v-248a160.45 160.45 0 0 0-2.2-27.68c7.42-17.77 22.34-38.8 51.37-38.8 35.13 0 52.2 23.31 52.2 71.28V588z"></path></svg></a><div class="tu l"><p class="bn b gr bp tv"><a class="au av aw ax ay az ba bb bc bd tw bg tr ts kx" href="https://medium.com/about?autoplay=1&amp;source=post_page-----d06c8b941505--------------------------------" rel="noopener follow">About</a><a class="au av aw ax ay az ba bb bc bd tw bg tr ts kx" href="https://help.medium.com/hc/en-us?source=post_page-----d06c8b941505--------------------------------" rel="noopener follow">Help</a><a class="au av aw ax ay az ba bb bc bd tw bg tr ts kx" href="https://policy.medium.com/medium-terms-of-service-9db0094a1e0f?source=post_page-----d06c8b941505--------------------------------" rel="noopener follow">Terms</a><a class="au av aw ax ay az ba bb bc bd tw bg tr ts" href="https://policy.medium.com/medium-privacy-policy-f03bf92035c9?source=post_page-----d06c8b941505--------------------------------" rel="noopener follow">Privacy</a></p></div><div class="j i d"><hr class="dt du tx ty" aria-hidden="true"/><h2 class="bn pi do bp ih tv">Get the Medium app</h2><div class="tu o"><div class="gc l"><a class="au av aw ax ay az ba bb bc bd tp tq bg tr ts" href="https://itunes.apple.com/app/medium-everyones-stories/id828256236?pt=698524&amp;mt=8&amp;ct=post_page&amp;source=post_page-----d06c8b941505--------------------------------" rel="noopener follow"><img alt="A button that says &#x27;Download on the App Store&#x27;, and if clicked it will lead you to the iOS App store" class="" src="https://miro.medium.com/max/270/1*Crl55Tm6yDNMoucPo1tvDg.png" width="135" height="41"/></a></div><a class="au av aw ax ay az ba bb bc bd tp tq bg tr ts" href="https://play.google.com/store/apps/details?id=com.medium.reader&amp;source=post_page-----d06c8b941505--------------------------------" rel="noopener follow"><img alt="A button that says &#x27;Get it on, Google Play&#x27;, and if clicked it will lead you to the Google Play store" class="" src="https://miro.medium.com/max/270/1*W_RAPQ62h0em559zluJLdQ.png" width="135" height="41"/></a></div></div></div></div></div></div></div></main><div class="eq ci c er h k j i cv es et eu"><div class="ag cf cj dq"><div class="l dc aq"><div class="es o db"><div class="l ot"><div class="l c"><div class="l"><div class="qk o ao"><div class="pw-susi-button l ot"><span><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/m/signin?operation=register&amp;redirect=https%3A%2F%2Fizyknows.medium.com%2Flinux-auditd-for-threat-detection-d06c8b941505&amp;source=post_page--------------------------nav_reg-----------" rel="noopener follow"><button class="bn b bo bp bq br bs bt bu bv bw bx by bz ca cb cc cd ce cf cg ch ci cj ck" aria-label="sign up">Get started</button></a></span></div></div></div><div class="tz l"><div class="o hs nl ua"><div class="cj" aria-hidden="false" aria-describedby="searchResults" aria-labelledby="searchResults"></div><span class="uf l"><svg width="25" height="25" viewBox="0 0 25 25" fill="rgba(8, 8, 8, 1)"><path d="M20.07 18.93l-4.16-4.15a6 6 0 1 0-.88.88l4.15 4.16a.62.62 0 1 0 .89-.89zM6.5 11a4.75 4.75 0 1 1 9.5 0 4.75 4.75 0 0 1-9.5 0z"></path></svg></span><input role="combobox" aria-controls="searchResults" aria-expanded="false" aria-label="search" tabindex="0" class="eb ub bn bo bp kx cf uc ud gj ue" placeholder="Search" value=""/></div><div class="ug l"></div><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" rel="noopener follow" href="/"><div class="l dq"><img alt="IzyKnows" class="l ci ge uh ui gi" src="https://miro.medium.com/freeze/fit/c/176/176/1*bxTMCz_6YjvWzrkEFA7-Zg.gif" width="88" height="88"/><div class="gd ge l uh ui gh aq"></div></div></a><div class="uj l"></div><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" rel="noopener follow" href="/"><h2 class="pw-author-name bn pi do bp ih gj">IzyKnows</h2></a><div class="uk l"></div><span class="pw-follower-count bn b do dp co"><button class="au av aw ax ay az ba bb bc bd be bf bg bh bi">31 Followers</button></span><div class="ul l"></div><p class="bn b bo bp co">I like to break things :)</p><div class="um l"></div><div class="un o"><span><button class="bn b bo bp gs br gu gv gw gx gy bd ca gz ha hb ce uo cg ch ci cj ck">Follow</button></span><div class="qc l"><div><div><div class="cj" aria-hidden="false"><div class="l"><span><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/m/signin?actionUrl=%2F_%2Fapi%2Fsubscriptions%2Fnewsletters%2Ffdbac678d578&amp;operation=register&amp;redirect=https%3A%2F%2Fizyknows.medium.com%2Flinux-auditd-for-threat-detection-d06c8b941505&amp;newsletterV3=fd25d228e7cd&amp;newsletterV3Id=fdbac678d578&amp;user=IzyKnows&amp;userId=fd25d228e7cd&amp;source=--------------------------subscribe_user-----------" rel="noopener follow"><button class="bn b bo bp bq bb bs bt bu bv bw bx by bz ca gz ha hb ce cg ch ci cj ck" aria-label="Subscribe"><svg width="38" height="38" viewBox="0 0 38 38" fill="none" class="qd qe qf"><rect x="26.25" y="9.25" width="0.5" height="6.5" rx="0.25"></rect><rect x="29.75" y="12.25" width="0.5" height="6.5" rx="0.25" transform="rotate(90 29.75 12.25)"></rect><path d="M19.5 12.5h-7a1 1 0 0 0-1 1v11a1 1 0 0 0 1 1h13a1 1 0 0 0 1-1v-5"></path><path d="M11.5 14.5L19 20l4-3"></path></svg></button></a></span></div></div></div></div></div></div><div class="kr l"><div class="l"><div class="ss ug l"><h2 class="bn pi do bp ih gj">More from <!-- -->Medium</h2></div><div class="l"><div class="cf ag"><a href="https://medium.com/@casimkhan/attack-simulation-why-it-is-important-abbd342b861f?source=read_next_recirc---------0---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@casimkhan?source=read_next_recirc---------0---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="l dq"><img alt="Covertshell" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*LV3Feh1sLdtgJbGFJGT4sQ@2x.jpeg" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@casimkhan?source=read_next_recirc---------0---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Covertshell</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Attack Simulation (Why it is Important!) Part 1 — Building the foundation</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*3HQ7b7j3S7391Fjz_UD_vQ.png" width="56" role="presentation"/></div></div></div></div></div></a></div><div class="cf ag"><a href="https://socfortress.medium.com/using-wazuh-stack-to-run-network-scans-e12525c60712?source=read_next_recirc---------1---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://socfortress.medium.com/?source=read_next_recirc---------1---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="l dq"><img alt="SOCFortress" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*cHP8DbSurq9-y7eiervxzw.png" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://socfortress.medium.com/?source=read_next_recirc---------1---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">SOCFortress</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Using Wazuh Stack to run Network Scans</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*bt8hhus8mWkGjPbE5rDqcA.png" width="56" role="presentation"/></div></div></div></div></div></a></div><div class="cf ag"><a href="https://warnerchad.medium.com/yara-rules-in-cyber-threat-intelligence-b108013b7162?source=read_next_recirc---------2---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://warnerchad.medium.com/?source=read_next_recirc---------2---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="l dq"><img alt="Chad Warner" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/1*nPdCNVXWlAWQ9BEneYtwYA.jpeg" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://warnerchad.medium.com/?source=read_next_recirc---------2---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Chad Warner</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>YARA Rules in Cyber Threat Intelligence</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*CkKv6zWhxXlHgGWPedV6SQ.jpeg" width="56" role="presentation"/></div></div></div></div></div></a></div><div class="cf ag"><a href="https://medium.com/@adanafigen/fundamentals-of-dmz-network-c336c12c3b73?source=read_next_recirc---------3---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="ss o db dz"><div class="o gl u"><div class="st o db su"><div class="sv o ao"><div class="sw l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@adanafigen?source=read_next_recirc---------3---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><div class="l dq"><img alt="Figen Adana" class="l ci ge sx sy gi" src="https://miro.medium.com/fit/c/40/40/0*vRaeBgbs0vlYui_X" width="20" height="20"/><div class="gd ge l sx sy gh aq"></div></div></a></div><div class="hh l"><div><div class="cj" aria-hidden="false"><div class="o"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/@adanafigen?source=read_next_recirc---------3---------------------cb811b62_c36f_4e22_ba13_1d16584b099b-------" rel="noopener follow"><p class="bn b gr bp pv sz pw px py pz qa qb gj">Figen Adana</p></a></div></div></div></div></div><h2 class="bn ij do bp pv ta pw px tb pz qb ih gj"><div>Fundamentals of DMZ Network</div></h2></div><div class="tc l"><div class="m l dq gi"><div class="td te l"><img alt="" class="tf" src="https://miro.medium.com/focal/112/112/50/50/1*SM4DDGlVXQhy8q_CvYnBDA.png" width="56" role="presentation"/></div></div></div></div></div></a></div></div></div></div></div></div></div><div class="up o gl hc"><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://help.medium.com/hc/en-us" rel="noopener follow"><p class="bn b ur us co">Help</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.statuspage.io" rel="noopener follow"><p class="bn b ur us co">Status</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://about.medium.com/creators/" rel="noopener follow"><p class="bn b ur us co">Writers</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://blog.medium.com" rel="noopener follow"><p class="bn b ur us co">Blog</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e" rel="noopener follow"><p class="bn b ur us co">Careers</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://policy.medium.com/medium-privacy-policy-f03bf92035c9" rel="noopener follow"><p class="bn b ur us co">Privacy</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://policy.medium.com/medium-terms-of-service-9db0094a1e0f" rel="noopener follow"><p class="bn b ur us co">Terms</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://medium.com/about?autoplay=1" rel="noopener follow"><p class="bn b ur us co">About</p></a></div><div class="uq l"><a class="au av aw ax ay az ba bb bc bd be bf bg bh bi" href="https://knowable.fyi" rel="noopener follow"><p class="bn b ur us co">Knowable</p></a></div></div></div></div></div></div></div></div></div></div></div><script>window.__BUILD_ID__="main-20220610-150737-163c4d074c"</script><script>window.__GRAPHQL_URI__ = "https://izyknows.medium.com/_/graphql"</script><script>window.__PRELOADED_STATE__ = {"algolia":{"queries":{}},"auroraPage":{"isAuroraPageEnabled":false},"cache":{"experimentGroupSet":true,"reason":"","group":"enabled","tags":["group-edgeCachePosts","post-d06c8b941505","user-fd25d228e7cd"],"serverVariantState":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","middlewareEnabled":true,"cacheStatus":"DYNAMIC","shouldUseCache":true,"vary":[]},"client":{"hydrated":false,"isUs":false,"isNativeMedium":false,"isSafariMobile":true,"isSafari":true,"isFirefox":false,"routingEntity":{"type":"USER","id":"fd25d228e7cd","explicit":true},"viewerIsBot":false},"debug":{"requestId":"02906c7f-cc93-4993-9fdd-b22ef824d718","hybridDevServices":[],"originalSpanCarrier":{"ot-tracer-spanid":"70b6bcc16c31b6c0","ot-tracer-traceid":"662706e5197b1acb","ot-tracer-sampled":"true"}},"multiVote":{"clapsPerPost":{}},"navigation":{"branch":{"show":null,"hasRendered":null,"blockedByCTA":false},"hideGoogleOneTap":false,"hasRenderedAlternateUserBanner":null,"currentLocation":"https:\u002F\u002Fizyknows.medium.com\u002Flinux-auditd-for-threat-detection-d06c8b941505","host":"izyknows.medium.com","hostname":"izyknows.medium.com","referrer":"","hasSetReferrer":false,"susiModal":{"step":null,"operation":"register"},"postRead":false,"queryString":"","currentHash":""},"tracing":{},"config":{"nodeEnv":"production","version":"main-20220610-150737-163c4d074c","isTaggedVersion":false,"target":"production","productName":"Medium","publicUrl":"https:\u002F\u002Fcdn-client.medium.com\u002Flite","authDomain":"medium.com","authGoogleClientId":"216296035834-k1k6qe060s2tp2a2jam4ljdcms00sttg.apps.googleusercontent.com","favicon":"production","glyphUrl":"https:\u002F\u002Fglyph.medium.com","branchKey":"key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm","lightStep":{"name":"lite-web","host":"lightstep.medium.systems","token":"ce5be895bef60919541332990ac9fef2","appVersion":"main-20220610-150737-163c4d074c","disableClientReporting":true},"algolia":{"appId":"MQ57UUUQZ2","apiKeySearch":"394474ced050e3911ae2249ecc774921","indexPrefix":"medium_","host":"-dsn.algolia.net"},"recaptchaKey":"6Lfc37IUAAAAAKGGtC6rLS13R1Hrw_BqADfS1LRk","recaptcha3Key":"6Lf8R9wUAAAAABMI_85Wb8melS7Zj6ziuf99Yot5","datadog":{"applicationId":"6702d87d-a7e0-42fe-bbcb-95b469547ea0","clientToken":"pub853ea8d17ad6821d9f8f11861d23dfed","rumToken":"pubf9cc52896502b9413b68ba36fc0c7162","context":{"deployment":{"target":"production","tag":"main-20220610-150737-163c4d074c","commit":"163c4d074c155e104c86b16b587563d165466d05"}},"datacenter":"us"},"googleAnalyticsCode":"UA-24232453-2","googlePay":{"apiVersion":"2","apiVersionMinor":"0","merchantId":"BCR2DN6TV7EMTGBM","merchantName":"Medium","instanceMerchantId":"13685562959212738550"},"applePay":{"version":3},"signInWallCustomDomainCollectionIds":["3a8144eabfe3","336d898217ee","61061eb0c96b","138adf9c44c","819cc2aaeee0"],"mediumOwnedAndOperatedCollectionIds":["8a9336e5bb4","b7e45b22fec3","193b68bd4fba","8d6b8a439e32","54c98c43354d","3f6ecf56618","d944778ce714","92d2092dc598","ae2a65f35510","1285ba81cada","544c7006046e","fc8964313712","40187e704f1c","88d9857e584e","7b6769f2748b","bcc38c8f6edf","cef6983b292","cb8577c9149e","444d13b52878","713d7dbc99b0","ef8e90590e66","191186aaafa0","55760f21cdc5","9dc80918cc93","bdc4052bbdba","8ccfed20cbb2"],"tierOneDomains":["medium.com","thebolditalic.com","arcdigital.media","towardsdatascience.com","uxdesign.cc","codeburst.io","psiloveyou.xyz","writingcooperative.com","entrepreneurshandbook.co","prototypr.io","betterhumans.coach.me","theascent.pub"],"topicsToFollow":["d61cf867d93f","8a146bc21b28","1eca0103fff3","4d562ee63426","aef1078a3ef5","e15e46793f8d","6158eb913466","55f1c20aba7a","3d18b94f6858","4861fee224fd","63c6f1f93ee","1d98b3a9a871","decb52b64abf","ae5d4995e225","830cded25262"],"topicToTagMappings":{"accessibility":"accessibility","addiction":"addiction","android-development":"android-development","art":"art","artificial-intelligence":"artificial-intelligence","astrology":"astrology","basic-income":"basic-income","beauty":"beauty","biotech":"biotech","blockchain":"blockchain","books":"books","business":"business","cannabis":"cannabis","cities":"cities","climate-change":"climate-change","comics":"comics","coronavirus":"coronavirus","creativity":"creativity","cryptocurrency":"cryptocurrency","culture":"culture","cybersecurity":"cybersecurity","data-science":"data-science","design":"design","digital-life":"digital-life","disability":"disability","economy":"economy","education":"education","equality":"equality","family":"family","feminism":"feminism","fiction":"fiction","film":"film","fitness":"fitness","food":"food","freelancing":"freelancing","future":"future","gadgets":"gadgets","gaming":"gaming","gun-control":"gun-control","health":"health","history":"history","humor":"humor","immigration":"immigration","ios-development":"ios-development","javascript":"javascript","justice":"justice","language":"language","leadership":"leadership","lgbtqia":"lgbtqia","lifestyle":"lifestyle","machine-learning":"machine-learning","makers":"makers","marketing":"marketing","math":"math","media":"media","mental-health":"mental-health","mindfulness":"mindfulness","money":"money","music":"music","neuroscience":"neuroscience","nonfiction":"nonfiction","outdoors":"outdoors","parenting":"parenting","pets":"pets","philosophy":"philosophy","photography":"photography","podcasts":"podcast","poetry":"poetry","politics":"politics","privacy":"privacy","product-management":"product-management","productivity":"productivity","programming":"programming","psychedelics":"psychedelics","psychology":"psychology","race":"race","relationships":"relationships","religion":"religion","remote-work":"remote-work","san-francisco":"san-francisco","science":"science","self":"self","self-driving-cars":"self-driving-cars","sexuality":"sexuality","social-media":"social-media","society":"society","software-engineering":"software-engineering","space":"space","spirituality":"spirituality","sports":"sports","startups":"startup","style":"style","technology":"technology","transportation":"transportation","travel":"travel","true-crime":"true-crime","tv":"tv","ux":"ux","venture-capital":"venture-capital","visual-design":"visual-design","work":"work","world":"world","writing":"writing"},"defaultImages":{"avatar":{"imageId":"1*dmbNkD5D-u45r44go_cf0g.png","height":150,"width":150},"orgLogo":{"imageId":"1*OMF3fSqH8t4xBJ9-6oZDZw.png","height":106,"width":545},"postLogo":{"imageId":"1*kFrc4tBFM_tCis-2Ic87WA.png","height":810,"width":1440},"postPreviewImage":{"imageId":"1*hn4v1tCaJy7cWMyb0bpNpQ.png","height":386,"width":579}},"collectionStructuredData":{"8d6b8a439e32":{"name":"Elemental","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fcdn-images-1.medium.com\u002Fmax\u002F980\u002F1*9ygdqoKprhwuTVKUM0DLPA@2x.png","width":980,"height":159}}},"3f6ecf56618":{"name":"Forge","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fcdn-images-1.medium.com\u002Fmax\u002F596\u002F1*uULpIlImcO5TDuBZ6lm7Lg@2x.png","width":596,"height":183}}},"ae2a65f35510":{"name":"GEN","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F264\u002F1*RdVZMdvfV3YiZTw6mX7yWA.png","width":264,"height":140}}},"88d9857e584e":{"name":"LEVEL","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F540\u002F1*JqYMhNX6KNNb2UlqGqO2WQ.png","width":540,"height":108}}},"7b6769f2748b":{"name":"Marker","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fcdn-images-1.medium.com\u002Fmax\u002F383\u002F1*haCUs0wF6TgOOvfoY-jEoQ@2x.png","width":383,"height":92}}},"444d13b52878":{"name":"OneZero","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F540\u002F1*cw32fIqCbRWzwJaoQw6BUg.png","width":540,"height":123}}},"8ccfed20cbb2":{"name":"Zora","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F540\u002F1*tZUQqRcCCZDXjjiZ4bDvgQ.png","width":540,"height":106}}}},"embeddedPostIds":{"coronavirus":"cd3010f9d81f"},"sharedCdcMessaging":{"COVID_APPLICABLE_TAG_SLUGS":[],"COVID_APPLICABLE_TOPIC_NAMES":[],"COVID_APPLICABLE_TOPIC_NAMES_FOR_TOPIC_PAGE":[],"COVID_MESSAGES":{"tierA":{"text":"For more information on the novel coronavirus and Covid-19, visit cdc.gov.","markups":[{"start":66,"end":73,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]},"tierB":{"text":"Anyone can publish on Medium per our Policies, but we don’t fact-check every story. For more info about the coronavirus, see cdc.gov.","markups":[{"start":37,"end":45,"href":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Fcategories\u002F201931128-Policies-Safety"},{"start":125,"end":132,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]},"paywall":{"text":"This article has been made free for everyone, thanks to Medium Members. For more information on the novel coronavirus and Covid-19, visit cdc.gov.","markups":[{"start":56,"end":70,"href":"https:\u002F\u002Fmedium.com\u002Fmembership"},{"start":138,"end":145,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]},"unbound":{"text":"This article is free for everyone, thanks to Medium Members. For more information on the novel coronavirus and Covid-19, visit cdc.gov.","markups":[{"start":45,"end":59,"href":"https:\u002F\u002Fmedium.com\u002Fmembership"},{"start":127,"end":134,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]}},"COVID_BANNER_POST_ID_OVERRIDE_WHITELIST":["3b31a67bff4a"]},"sharedVoteMessaging":{"TAGS":["politics","election-2020","government","us-politics","election","2020-presidential-race","trump","donald-trump","democrats","republicans","congress","republican-party","democratic-party","biden","joe-biden","maga"],"TOPICS":["politics","election"],"MESSAGE":{"text":"Find out more about the U.S. election results here.","markups":[{"start":46,"end":50,"href":"https:\u002F\u002Fcookpolitical.com\u002F2020-national-popular-vote-tracker"}]},"EXCLUDE_POSTS":["397ef29e3ca5"]},"embedPostRules":[],"recircOptions":{"v1":{"limit":3},"v2":{"limit":8}},"braintreeClientKey":"production_zjkj96jm_m56f8fqpf7ngnrd4","braintree":{"enabled":true,"merchantId":"m56f8fqpf7ngnrd4","merchantAccountId":{"usd":"AMediumCorporation_instant","eur":"amediumcorporation_EUR","cad":"amediumcorporation_CAD"},"publicKey":"ds2nn34bg2z7j5gd","braintreeEnvironment":"production","dashboardUrl":"https:\u002F\u002Fwww.braintreegateway.com\u002Fmerchants","gracePeriodDurationInDays":14,"mediumMembershipPlanId":{"monthly":"ce105f8c57a3","monthlyWithTrial":"d5ee3dbe3db8","yearly":"a40ad4a43185","yearlyStaff":"d74fb811198a","yearlyWithTrial":"b3bc7350e5c7","monthlyCad":"p52orjkaceei","yearlyCad":"h4q9g2up9ktt"},"braintreeDiscountId":{"oneMonthFree":"MONTHS_FREE_01","threeMonthsFree":"MONTHS_FREE_03","sixMonthsFree":"MONTHS_FREE_06"},"3DSecureVersion":"2","defaultCurrency":"usd","providerPlanIdCurrency":{"4ycw":"usd","rz3b":"usd","3kqm":"usd","jzw6":"usd","c2q2":"usd","nnsw":"usd","fx7w":"cad","nwf2":"cad"}},"paypalClientId":"AXj1G4fotC2GE8KzWX9mSxCH1wmPE3nJglf4Z2ig_amnhvlMVX87otaq58niAg9iuLktVNF_1WCMnN7v","paypal":{"host":"https:\u002F\u002Fapi.paypal.com:443","clientMode":"production","serverMode":"live","webhookId":"4G466076A0294510S","monthlyPlan":{"planId":"P-9WR0658853113943TMU5FDQA","name":"Medium Membership (Monthly) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"yearlyPlan":{"planId":"P-7N8963881P8875835MU5JOPQ","name":"Medium Membership (Annual) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"oneYearGift":{"name":"Medium Membership (1 Year, Digital Gift Code)","description":"Unlimited access to the best and brightest stories on Medium. Gift codes can be redeemed at medium.com\u002Fredeem.","price":"50.00","currency":"USD","sku":"membership-gift-1-yr"},"oldMonthlyPlan":{"planId":"P-96U02458LM656772MJZUVH2Y","name":"Medium Membership (Monthly)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"oldYearlyPlan":{"planId":"P-59P80963JF186412JJZU3SMI","name":"Medium Membership (Annual)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"monthlyPlanWithTrial":{"planId":"P-66C21969LR178604GJPVKUKY","name":"Medium Membership (Monthly) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"yearlyPlanWithTrial":{"planId":"P-6XW32684EX226940VKCT2MFA","name":"Medium Membership (Annual) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"oldMonthlyPlanNoSetupFee":{"planId":"P-4N046520HR188054PCJC7LJI","name":"Medium Membership (Monthly)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"oldYearlyPlanNoSetupFee":{"planId":"P-7A4913502Y5181304CJEJMXQ","name":"Medium Membership (Annual)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"sdkUrl":"https:\u002F\u002Fwww.paypal.com\u002Fsdk\u002Fjs"},"stripePublishableKey":"pk_live_7FReX44VnNIInZwrIIx6ghjl","log":{"json":true,"level":"info"}},"session":{"xsrf":""}}</script><script>window.__APOLLO_STATE__ = {"ROOT_QUERY":{"__typename":"Query","user({\"id\":\"fd25d228e7cd\"})":{"__ref":"User:fd25d228e7cd"},"userResult({\"id\":\"fd25d228e7cd\"})":{"__ref":"User:fd25d228e7cd"},"collectionByDomainOrSlug({\"domainOrSlug\":\"izyknows.medium.com\"})":null,"postResult({\"id\":\"d06c8b941505\"})":{"__ref":"Post:d06c8b941505"},"recirc({\"paging\":{\"limit\":4},\"postId\":\"d06c8b941505\"})":{"__typename":"RexRecircResult","items":[{"__typename":"RexRecircItem","post":{"__ref":"Post:abbd342b861f"},"feedId":"cb811b62-c36f-4e22-ba13-1d16584b099b"},{"__typename":"RexRecircItem","post":{"__ref":"Post:e12525c60712"},"feedId":"cb811b62-c36f-4e22-ba13-1d16584b099b"},{"__typename":"RexRecircItem","post":{"__ref":"Post:b108013b7162"},"feedId":"cb811b62-c36f-4e22-ba13-1d16584b099b"},{"__typename":"RexRecircItem","post":{"__ref":"Post:c336c12c3b73"},"feedId":"cb811b62-c36f-4e22-ba13-1d16584b099b"}]}},"User:fd25d228e7cd":{"id":"fd25d228e7cd","__typename":"User","customStyleSheet":null,"name":"IzyKnows","username":"izyknows","newsletterV3":{"__ref":"NewsletterV3:fdbac678d578"},"imageId":"1*bxTMCz_6YjvWzrkEFA7-Zg.gif","socialStats":{"__typename":"SocialStats","followerCount":31,"followingCount":2,"collectionFollowingCount":0},"bio":"I like to break things :)","isPartnerProgramEnrolled":false,"viewerEdge":{"__ref":"UserViewerEdge:userId:fd25d228e7cd-viewerId:lo_109b2f48a593"},"viewerIsUser":false,"customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"izyknows.medium.com","status":"ACTIVE","isSubdomain":true}},"hasSubdomain":true,"postSubscribeMembershipUpsellShownAt":0,"isSuspended":false,"about":"I like to break things :) @izysec","homepagePostsConnection({\"paging\":{\"limit\":1}})":{"__typename":"PostConnection","posts":[{"__ref":"Post:d06c8b941505"}]},"mediumMemberAt":0,"allowNotes":true,"twitterScreenName":"","referredMembershipCustomHeadline":"","referredMembershipCustomBody":"","isAuroraVisible":true,"atsQualifiedAt":1614188690506,"followersUserConnection({\"paging\":{\"limit\":10}})":{"__typename":"UserConnection","users":[{"__ref":"User:198d1b38e7fc"},{"__ref":"User:30eb894871e7"},{"__ref":"User:368680099881"},{"__ref":"User:3d7a70f44446"},{"__ref":"User:42a8e7a4c4d5"},{"__ref":"User:500f3861515f"},{"__ref":"User:54338937cc3a"},{"__ref":"User:5f75ec4292a"},{"__ref":"User:6de29deeaecf"}],"pagingInfo":{"__typename":"Paging","next":{"__typename":"PageParams","to":null,"from":"6de29deeaecf","limit":10}}}},"UserViewerEdge:userId:fd25d228e7cd-viewerId:lo_109b2f48a593":{"id":"userId:fd25d228e7cd-viewerId:lo_109b2f48a593","__typename":"UserViewerEdge","isFollowing":false,"isUser":false},"NewsletterV3:fdbac678d578":{"id":"fdbac678d578","__typename":"NewsletterV3","type":"NEWSLETTER_TYPE_AUTHOR","slug":"fd25d228e7cd","name":"fd25d228e7cd","collection":null,"user":{"__ref":"User:fd25d228e7cd"},"description":"","promoHeadline":"","promoBody":"","showPromo":false,"subscribersCount":2},"Post:d06c8b941505":{"id":"d06c8b941505","__typename":"Post","firstPublishedAt":1643187802663,"visibility":"PUBLIC","creator":{"__ref":"User:fd25d228e7cd"},"canonicalUrl":"","collection":null,"content({\"postMeteringOptions\":null})":{"__typename":"PostContent","isLockedPreviewOnly":false,"validatedShareKey":"","bodyModel":{"__typename":"RichText","paragraphs":[{"__ref":"Paragraph:d2169ee3d73a_0"},{"__ref":"Paragraph:d2169ee3d73a_1"},{"__ref":"Paragraph:d2169ee3d73a_2"},{"__ref":"Paragraph:d2169ee3d73a_3"},{"__ref":"Paragraph:d2169ee3d73a_4"},{"__ref":"Paragraph:d2169ee3d73a_5"},{"__ref":"Paragraph:d2169ee3d73a_6"},{"__ref":"Paragraph:d2169ee3d73a_7"},{"__ref":"Paragraph:d2169ee3d73a_8"},{"__ref":"Paragraph:d2169ee3d73a_9"},{"__ref":"Paragraph:d2169ee3d73a_10"},{"__ref":"Paragraph:d2169ee3d73a_11"},{"__ref":"Paragraph:d2169ee3d73a_12"},{"__ref":"Paragraph:d2169ee3d73a_13"},{"__ref":"Paragraph:d2169ee3d73a_14"},{"__ref":"Paragraph:d2169ee3d73a_15"},{"__ref":"Paragraph:d2169ee3d73a_16"},{"__ref":"Paragraph:d2169ee3d73a_17"},{"__ref":"Paragraph:d2169ee3d73a_18"},{"__ref":"Paragraph:d2169ee3d73a_19"},{"__ref":"Paragraph:d2169ee3d73a_20"},{"__ref":"Paragraph:d2169ee3d73a_21"},{"__ref":"Paragraph:d2169ee3d73a_22"},{"__ref":"Paragraph:d2169ee3d73a_23"},{"__ref":"Paragraph:d2169ee3d73a_24"},{"__ref":"Paragraph:d2169ee3d73a_25"},{"__ref":"Paragraph:d2169ee3d73a_26"},{"__ref":"Paragraph:d2169ee3d73a_27"},{"__ref":"Paragraph:d2169ee3d73a_28"},{"__ref":"Paragraph:d2169ee3d73a_29"},{"__ref":"Paragraph:d2169ee3d73a_30"},{"__ref":"Paragraph:d2169ee3d73a_31"},{"__ref":"Paragraph:d2169ee3d73a_32"},{"__ref":"Paragraph:d2169ee3d73a_33"},{"__ref":"Paragraph:d2169ee3d73a_34"},{"__ref":"Paragraph:d2169ee3d73a_35"},{"__ref":"Paragraph:d2169ee3d73a_36"},{"__ref":"Paragraph:d2169ee3d73a_37"},{"__ref":"Paragraph:d2169ee3d73a_38"},{"__ref":"Paragraph:d2169ee3d73a_39"},{"__ref":"Paragraph:d2169ee3d73a_40"},{"__ref":"Paragraph:d2169ee3d73a_41"},{"__ref":"Paragraph:d2169ee3d73a_42"},{"__ref":"Paragraph:d2169ee3d73a_43"},{"__ref":"Paragraph:d2169ee3d73a_44"},{"__ref":"Paragraph:d2169ee3d73a_45"},{"__ref":"Paragraph:d2169ee3d73a_46"},{"__ref":"Paragraph:d2169ee3d73a_47"},{"__ref":"Paragraph:d2169ee3d73a_48"},{"__ref":"Paragraph:d2169ee3d73a_49"},{"__ref":"Paragraph:d2169ee3d73a_50"},{"__ref":"Paragraph:d2169ee3d73a_51"},{"__ref":"Paragraph:d2169ee3d73a_52"},{"__ref":"Paragraph:d2169ee3d73a_53"},{"__ref":"Paragraph:d2169ee3d73a_54"},{"__ref":"Paragraph:d2169ee3d73a_55"},{"__ref":"Paragraph:d2169ee3d73a_56"},{"__ref":"Paragraph:d2169ee3d73a_57"},{"__ref":"Paragraph:d2169ee3d73a_58"},{"__ref":"Paragraph:d2169ee3d73a_59"},{"__ref":"Paragraph:d2169ee3d73a_60"},{"__ref":"Paragraph:d2169ee3d73a_61"},{"__ref":"Paragraph:d2169ee3d73a_62"},{"__ref":"Paragraph:d2169ee3d73a_63"},{"__ref":"Paragraph:d2169ee3d73a_64"},{"__ref":"Paragraph:d2169ee3d73a_65"}],"sections":[{"__typename":"Section","name":"0ab7","startIndex":0,"textLayout":null,"imageLayout":null,"backgroundImage":null,"videoLayout":null,"backgroundVideo":null},{"__typename":"Section","name":"2791","startIndex":10,"textLayout":null,"imageLayout":null,"backgroundImage":null,"videoLayout":null,"backgroundVideo":null},{"__typename":"Section","name":"8d26","startIndex":46,"textLayout":null,"imageLayout":null,"backgroundImage":null,"videoLayout":null,"backgroundVideo":null},{"__typename":"Section","name":"ee27","startIndex":62,"textLayout":null,"imageLayout":null,"backgroundImage":null,"videoLayout":null,"backgroundVideo":null}]}},"customStyleSheet":null,"isPublished":true,"isLocked":false,"license":"ALL_RIGHTS_RESERVED","collaborators":[],"awards:(type:STAFF_PICK,limit:8)":{"__typename":"AwardConnection","awards":[],"totalCount":0},"isMarkedPaywallOnly":false,"mediumUrl":"https:\u002F\u002Fizyknows.medium.com\u002Flinux-auditd-for-threat-detection-d06c8b941505","allowResponses":true,"postResponses":{"__typename":"PostResponses","count":0},"isLimitedState":false,"isNewsletter":false,"layerCake":0,"tags":[{"__ref":"Tag:linux"},{"__ref":"Tag:blue-team"},{"__ref":"Tag:threat-hunting"},{"__ref":"Tag:cybersecurity"},{"__ref":"Tag:incident-response"}],"topics":[{"__typename":"Topic","name":"Cybersecurity"},{"__typename":"Topic","name":"Programming"}],"isSeries":false,"sequence":null,"uniqueSlug":"linux-auditd-for-threat-detection-d06c8b941505","primaryTopic":null,"socialTitle":"","socialDek":"","noIndex":null,"curationStatus":"CURATION_STATUS_DISABLED","metaDescription":"","latestPublishedAt":1643274676275,"readingTime":8.715094339622642,"previewContent":{"__typename":"PreviewContent","subtitle":"A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large…"},"previewImage":{"__ref":"ImageMetadata:0*cpEg2_eJmcCq1CZW.png"},"isShortform":false,"isSuspended":false,"responseRootPost":{"__typename":"ResponseRootPost","post":{"__ref":"Post:d06c8b941505"}},"lockedSource":"LOCKED_POST_SOURCE_NONE","statusForCollection":null,"pendingCollection":null,"title":"Linux Auditd for Threat Detection","inResponseToEntityType":null,"seoTitle":"","updatedAt":1643423640762,"shortformType":"SHORTFORM_TYPE_LINK","seoDescription":"","isIndexable":true,"pinnedAt":0,"internalLinks({\"paging\":{\"limit\":8}})":{"__typename":"InternalLinksConnection","items":[{"__ref":"Post:c956b2897e1b"},{"__ref":"Post:979d9500c868"},{"__ref":"Post:98d159d44fab"},{"__ref":"Post:f8ab46c72fe9"},{"__ref":"Post:c2afa4200b97"},{"__ref":"Post:f2a78f45a76a"},{"__ref":"Post:bf6339926bc9"},{"__ref":"Post:3fe2f70f879a"}]},"clapCount":46,"pinnedByCreatorAt":0,"curationEligibleAt":0,"responseDistribution":"NOT_DISTRIBUTED","inResponseToPostResult":null,"inResponseToCatalogResult":null,"latestPublishedVersion":"d2169ee3d73a","isAuthorNewsletter":false,"voterCount":20,"recommenders":[]},"User:15ed74f4916a":{"id":"15ed74f4916a","__typename":"User","imageId":"1*LV3Feh1sLdtgJbGFJGT4sQ@2x.jpeg","mediumMemberAt":0,"name":"Covertshell","username":"casimkhan","customDomainState":null,"hasSubdomain":false,"bio":"Cyber security enthusiast | blue team | DFIR"},"ImageMetadata:1*3HQ7b7j3S7391Fjz_UD_vQ.png":{"id":"1*3HQ7b7j3S7391Fjz_UD_vQ.png","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:abbd342b861f":{"id":"abbd342b861f","__typename":"Post","title":"Attack Simulation (Why it is Important!) Part 1 — Building the foundation","mediumUrl":"https:\u002F\u002Fmedium.com\u002F@casimkhan\u002Fattack-simulation-why-it-is-important-abbd342b861f","creator":{"__ref":"User:15ed74f4916a"},"previewContent":{"__typename":"PreviewContent","subtitle":"This topic will be divided into 3 part series:","isFullContent":false},"collection":null,"previewImage":{"__ref":"ImageMetadata:1*3HQ7b7j3S7391Fjz_UD_vQ.png"},"clapCount":10,"visibility":"PUBLIC","isSeries":false,"sequence":null,"uniqueSlug":"attack-simulation-why-it-is-important-abbd342b861f"},"User:36613248f635":{"id":"36613248f635","__typename":"User","imageId":"1*cHP8DbSurq9-y7eiervxzw.png","mediumMemberAt":1642387436000,"name":"SOCFortress","username":"socfortress","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"socfortress.medium.com"}},"hasSubdomain":true,"bio":"SOCFortress is a SaaS company that unifies Observability, Security Monitoring, Threat Intelligence and Security Orchestration, Automation, and Response (SOAR)."},"ImageMetadata:1*bt8hhus8mWkGjPbE5rDqcA.png":{"id":"1*bt8hhus8mWkGjPbE5rDqcA.png","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:e12525c60712":{"id":"e12525c60712","__typename":"Post","title":"Using Wazuh Stack to run Network Scans","mediumUrl":"https:\u002F\u002Fsocfortress.medium.com\u002Fusing-wazuh-stack-to-run-network-scans-e12525c60712","creator":{"__ref":"User:36613248f635"},"previewContent":{"__typename":"PreviewContent","subtitle":"Intro","isFullContent":false},"collection":null,"previewImage":{"__ref":"ImageMetadata:1*bt8hhus8mWkGjPbE5rDqcA.png"},"clapCount":0,"visibility":"PUBLIC","isSeries":false,"sequence":null,"uniqueSlug":"using-wazuh-stack-to-run-network-scans-e12525c60712"},"User:f2af55c3650c":{"id":"f2af55c3650c","__typename":"User","imageId":"1*nPdCNVXWlAWQ9BEneYtwYA.jpeg","mediumMemberAt":0,"name":"Chad Warner","username":"warnerchad","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"warnerchad.medium.com"}},"hasSubdomain":true,"bio":"Cyber threat intelligence (CTI), cybersecurity, & privacy enthusiast. Bookworm. Fan of Tolkien & LEGO."},"ImageMetadata:1*CkKv6zWhxXlHgGWPedV6SQ.jpeg":{"id":"1*CkKv6zWhxXlHgGWPedV6SQ.jpeg","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:b108013b7162":{"id":"b108013b7162","__typename":"Post","title":"YARA Rules in Cyber Threat Intelligence","mediumUrl":"https:\u002F\u002Fwarnerchad.medium.com\u002Fyara-rules-in-cyber-threat-intelligence-b108013b7162","creator":{"__ref":"User:f2af55c3650c"},"previewContent":{"__typename":"PreviewContent","subtitle":"YARA rules are pattern-matching rules used to identify malware. Many tools can use YARA rules to detect malware. YARA can be used on…","isFullContent":false},"collection":null,"previewImage":{"__ref":"ImageMetadata:1*CkKv6zWhxXlHgGWPedV6SQ.jpeg"},"clapCount":19,"visibility":"PUBLIC","isSeries":false,"sequence":null,"uniqueSlug":"yara-rules-in-cyber-threat-intelligence-b108013b7162"},"User:939a035a11d2":{"id":"939a035a11d2","__typename":"User","imageId":"0*vRaeBgbs0vlYui_X","mediumMemberAt":0,"name":"Figen Adana","username":"adanafigen","customDomainState":null,"hasSubdomain":false,"bio":""},"ImageMetadata:1*SM4DDGlVXQhy8q_CvYnBDA.png":{"id":"1*SM4DDGlVXQhy8q_CvYnBDA.png","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:c336c12c3b73":{"id":"c336c12c3b73","__typename":"Post","title":"Fundamentals of DMZ Network","mediumUrl":"https:\u002F\u002Fmedium.com\u002F@adanafigen\u002Ffundamentals-of-dmz-network-c336c12c3b73","creator":{"__ref":"User:939a035a11d2"},"previewContent":{"__typename":"PreviewContent","subtitle":"DMZ stands for Demilitarized Zone. We will provide an overview why organizations would need this and how a DMZ accomplish this security.","isFullContent":false},"collection":null,"previewImage":{"__ref":"ImageMetadata:1*SM4DDGlVXQhy8q_CvYnBDA.png"},"clapCount":560,"visibility":"PUBLIC","isSeries":false,"sequence":null,"uniqueSlug":"fundamentals-of-dmz-network-c336c12c3b73"},"Paragraph:d2169ee3d73a_0":{"id":"d2169ee3d73a_0","__typename":"Paragraph","name":"a660","text":"Configuring Linux auditd for Threat Detection","type":"H3","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_1":{"id":"d2169ee3d73a_1","__typename":"Paragraph","name":"2b40","text":"A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large organization. While I had a fair understanding of Linux systems, I found surprisingly little on utilizing auditd for at-scale security monitoring purposes.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_2":{"id":"d2169ee3d73a_2","__typename":"Paragraph","name":"1615","text":"The topics I look to cover in this article are","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_3":{"id":"d2169ee3d73a_3","__typename":"Paragraph","name":"ca0a","text":"Quick intro to the Linux Audit System","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_4":{"id":"d2169ee3d73a_4","__typename":"Paragraph","name":"9e96","text":"Tips when writing audit rules","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_5":{"id":"d2169ee3d73a_5","__typename":"Paragraph","name":"6df0","text":"Designing a configuration for security monitoring","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_6":{"id":"d2169ee3d73a_6","__typename":"Paragraph","name":"f2b4","text":"What to record with auditd","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_7":{"id":"d2169ee3d73a_7","__typename":"Paragraph","name":"3a92","text":"Tips on managing noise","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_8":{"id":"d2169ee3d73a_8","__typename":"Paragraph","name":"3165","text":"The end audience for this article is the security practitioners, IR, blue teamers who need to define what logs they need in their SIEM to detect bad activity. Going forward, I’m hoping things will get a lot easier with ePBF but we’ve never been good at completely eradicating older technologies now have we? :)","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_9":{"id":"d2169ee3d73a_9","__typename":"Paragraph","name":"1309","text":"There may be better ways to configure and utilize auditd, so feel free to share your experiences and I’d be happy to incorporate them here.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_10":{"id":"d2169ee3d73a_10","__typename":"Paragraph","name":"f7be","text":"The Linux Audit System","type":"H3","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"STRONG","start":0,"end":22,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_11":{"id":"d2169ee3d73a_11","__typename":"Paragraph","name":"1ae5","text":"The Linux Audit system provides a way to log events that happen on a Linux system. The recording options offered by the Audit system is extensive — process, network, file, user login\u002Flogout events, etc. In this series, I only focus on the security-relevant events from a detection standpoint. The entire list of types that can be recorded are listed here. This list will come handy when analyzing logs.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":350,"end":354,"href":"https:\u002F\u002Faccess.redhat.com\u002Fdocumentation\u002Fen-us\u002Fred_hat_enterprise_linux\u002F6\u002Fhtml\u002Fsecurity_guide\u002Fsec-audit_record_types","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_12":{"id":"d2169ee3d73a_12","__typename":"Paragraph","name":"613e","text":"By default, the packages required to use the Linux audit system are installed on many common distros. I won’t be covering the installation part here. “auditd” is the audit daemon that leverages the Linux audit system to write events to the disk. User-space applications make system calls which the kernel passes through certain filters and then finally through the “exclude” filter. The filters are important when it comes to writing auditd rules. I really like the diagram from Red Hat explaining it.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":479,"end":486,"href":"https:\u002F\u002Faccess.redhat.com\u002Fdocumentation\u002Fen-us\u002Fred_hat_enterprise_linux\u002F6\u002Fhtml\u002Fsecurity_guide\u002Fchap-system_auditing#sec-audit_system_architecture","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"STRONG","start":166,"end":173,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_13":{"id":"d2169ee3d73a_13","__typename":"Paragraph","name":"6499","text":"Audit System Architecture (source: RedHat)","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:0*cpEg2_eJmcCq1CZW.png"},"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_14":{"id":"d2169ee3d73a_14","__typename":"Paragraph","name":"2fa1","text":"By default, log files are written to \u002Fvar\u002Flog\u002Faudit\u002Faudit.log. You may find multiple audit.log files in the above directory all of particular max length.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_15":{"id":"d2169ee3d73a_15","__typename":"Paragraph","name":"8786","text":"The two files we particularly care about in the audit system are","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_16":{"id":"d2169ee3d73a_16","__typename":"Paragraph","name":"4672","text":"audit.rules: Tells the audit daemon what to record. This is where most of one’s time should go — deciding what events are most important to you","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_17":{"id":"d2169ee3d73a_17","__typename":"Paragraph","name":"953c","text":"audit.conf: Governs how the audit daemon runs. Log file location, buffer size, log rotation criteria, etc. I would not mess around too much with this file, but we’ll get to some important parameters of it later","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_18":{"id":"d2169ee3d73a_18","__typename":"Paragraph","name":"08d3","text":"The above was just a brief intro. There are better explanations of the Audit subsystem out there. The link to RedHat’s docs I mentioned above is a good one. Other good documents I can recommend are — Understanding Linux Audit from Suse, The Linux Audit Documentation Project","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":200,"end":235,"href":"https:\u002F\u002Fdocumentation.suse.com\u002Fsles\u002F12-SP4\u002Fhtml\u002FSLES-all\u002Fcha-audit-comp.html","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":237,"end":274,"href":"https:\u002F\u002Fgithub.com\u002Flinux-audit\u002Faudit-documentation\u002Fwiki","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_19":{"id":"d2169ee3d73a_19","__typename":"Paragraph","name":"4555","text":"Writing Audit rules","type":"H3","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"STRONG","start":0,"end":19,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_20":{"id":"d2169ee3d73a_20","__typename":"Paragraph","name":"e357","text":"What you specify in the audit.rules file is what finally lands up in the audit.log. When the audit daemon (auditd) is started (ensure that’s on system startup), rules defined in this file is what gives you events in the audit.log.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_21":{"id":"d2169ee3d73a_21","__typename":"Paragraph","name":"51d1","text":"The audit.rules file is located in \u002Fetc\u002Faudit\u002Faudit.rules. This is the final file that auditd refers when writing events to disk. Why I mention this is because, as mentioned at the top of the etc\u002Faudit\u002Faudit.rules file,","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_22":{"id":"d2169ee3d73a_22","__typename":"Paragraph","name":"86b2","text":"## This file is automatically generated from \u002Fetc\u002Faudit\u002Frules.d","type":"BQ","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_23":{"id":"d2169ee3d73a_23","__typename":"Paragraph","name":"d6c4","text":"That doesn’t mean you can’t add to it manually. However, in a large environment, you may have different rule files managed by different parties, that need to run together. You can place these different *.rules files within the \u002Fetc\u002Faudit\u002Frules.d\u002F directory. A utility named augenrules does the job of compiling the different *.rules files (in natural sort order) into the final \u002Fetc\u002Faudit\u002Faudit.rules . It’s worth mentioning that augenrules strips away comments and empty lines before generating audit.rules. I’m mentioning this as I’ve been accused of ridiculous things on this point by nutjobs in the past.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"EM","start":274,"end":285,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_24":{"id":"d2169ee3d73a_24","__typename":"Paragraph","name":"6442","text":"Coming to the rule writing. Let’s focus on the 2 types of rules that we’re interested in configuring","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_25":{"id":"d2169ee3d73a_25","__typename":"Paragraph","name":"fc3a","text":"File watches — can watch read, write, execute or attribute changes","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_26":{"id":"d2169ee3d73a_26","__typename":"Paragraph","name":"ce08","text":"Syscalls — record syscalls sent to the kernel by the application","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_27":{"id":"d2169ee3d73a_27","__typename":"Paragraph","name":"0c4c","text":"I’m not going to go into the depths of writing auditd rules, I recommend reading the man page for that.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":85,"end":93,"href":"https:\u002F\u002Flinux.die.net\u002Fman\u002F7\u002Faudit.rules","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_28":{"id":"d2169ee3d73a_28","__typename":"Paragraph","name":"feb5","text":"Some good references to look into when writing rules","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_29":{"id":"d2169ee3d73a_29","__typename":"Paragraph","name":"c425","text":"Inbuilt examples — https:\u002F\u002Fgithub.com\u002Flinux-audit\u002Faudit-userspace\u002Ftree\u002Fmaster\u002Frules","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":19,"end":83,"href":"https:\u002F\u002Fgithub.com\u002Flinux-audit\u002Faudit-userspace\u002Ftree\u002Fmaster\u002Frules","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_30":{"id":"d2169ee3d73a_30","__typename":"Paragraph","name":"e8fe","text":"MITRE-based rules — https:\u002F\u002Fgithub.com\u002Fbfuzzy1\u002Fauditd-attack\u002Ftree\u002Fmaster\u002Fauditd-attack","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":20,"end":86,"href":"https:\u002F\u002Fgithub.com\u002Fbfuzzy1\u002Fauditd-attack\u002Ftree\u002Fmaster\u002Fauditd-attack","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_31":{"id":"d2169ee3d73a_31","__typename":"Paragraph","name":"30c7","text":"Florian Roth’s best practice ruleset — https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fauditd","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":39,"end":72,"href":"https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fauditd","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_32":{"id":"d2169ee3d73a_32","__typename":"Paragraph","name":"2e1b","text":"https:\u002F\u002Fslack.engineering\u002Fsyscall-auditing-at-scale\u002F","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":0,"end":52,"href":"https:\u002F\u002Fslack.engineering\u002Fsyscall-auditing-at-scale\u002F","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_33":{"id":"d2169ee3d73a_33","__typename":"Paragraph","name":"cb95","text":"A few notes to keep in mind when building rules","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_34":{"id":"d2169ee3d73a_34","__typename":"Paragraph","name":"f373","text":"Utilize tagging — audit rules allow for tagging (-k) which is very helpful when analyzing events later. You could use your own custom tags or even tag rules with MITRE IDs (see bfuzzy1’s link above)","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_35":{"id":"d2169ee3d73a_35","__typename":"Paragraph","name":"c508","text":"When monitoring syscalls, it’s often better to monitor the syscall upon exit rather than entry (-always,exit). Important parameters may not be available at the time of function entry because they aren’t defined yet, hence you miss it too","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_36":{"id":"d2169ee3d73a_36","__typename":"Paragraph","name":"4a3e","text":"When doing syscall auditing always try to combine rules where you can (-a always,exit -S rmdir -S unlink -S rename). Each syscall rule gets evaluated for every syscall every program makes. It adds up, thereby impacting performance","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_37":{"id":"d2169ee3d73a_37","__typename":"Paragraph","name":"1c8a","text":"When writing rules, you may come across a filter criteria ‘-F auid!=4294967295’. This number is the equivalent of 0xFFFFFFFF which is the highest unsigned int number. It evaluates to -1 which in auditd world is equivalent to “unset”, i.e, it’s not defined yet. It’s common for this to happen with processes that initialize before the audit daemon. As in the audit.rules man page —","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":370,"end":378,"href":"https:\u002F\u002Fman7.org\u002Flinux\u002Fman-pages\u002Fman7\u002Faudit.rules.7.html","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_38":{"id":"d2169ee3d73a_38","__typename":"Paragraph","name":"1c7e","text":"“The audit system considers uids to be unsigned numbers. The audit\n system uses the number -1 to indicate that a loginuid is not set.\n This means that when it’s printed out, it looks like 4294967295.\n But when you write rules, you can use either “unset” which is\n easy to remember, or -1, or 4294967295. They are all equivalent.”","type":"BQ","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_39":{"id":"d2169ee3d73a_39","__typename":"Paragraph","name":"0f3f","text":"A note on exclusions — ensure your exclusions (-a never,exclude) are specific and placed on top so they get matched first. There are debates on whether specific includes or excludes should go on top. Specific includes would be the best for performance but I don’t find this a feasible option for large environments. Often times, the syscalls (like execve) are where you gain maximum visibility from a security detection perspective. Were you to place them right on top, you’d have little scope for performance tuning thereafter.","type":"ULI","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_40":{"id":"d2169ee3d73a_40","__typename":"Paragraph","name":"e7b0","text":"Configuration of the Audit Daemon","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"STRONG","start":0,"end":33,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_41":{"id":"d2169ee3d73a_41","__typename":"Paragraph","name":"66b1","text":"There are two places you can specify configurations for the audit daemon. One place is directly at the top of the audit.rules file as control rules and the other is in the audit.conf file. The configurations you can modify in both these places differ. Unless for a specific reason, I would not toy with the configurations of auditd except for a few","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_42":{"id":"d2169ee3d73a_42","__typename":"Paragraph","name":"6aab","text":"Backlog size: This can be set by using the -b keyword followed by the number of audit messages to buffer. The backlog option limits the number of messages that can be queued up waiting to be written to the log. Here, it’s recommended you start with the default and work your way up. On production level systems, I’ve seen 8192 as a feasible option. When the limit is breached, you should see a “backlog limit exceeded” in the logs and that can be your indicator to increase this buffer. Keep in mind, the higher buffer value, the more memory consumption on the system","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_43":{"id":"d2169ee3d73a_43","__typename":"Paragraph","name":"5a00","text":"Failure flag: Set with -f, it instructs auditd what to do when the above buffer is full. In production systems, you definitely don’t want disruption hence I recommend setting this to 1 so it prints in the log and nothing else","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_44":{"id":"d2169ee3d73a_44","__typename":"Paragraph","name":"ea97","text":"Enabled flag: Set with -e, can help ensure your audit configuration is not modified, i.e, immutable. Setting it to 2 will ensure that any changes will be denied and logged. Only a restart of the system can change the configuration. Remember, ensure this rule is the last rule in your ruleset.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_45":{"id":"d2169ee3d73a_45","__typename":"Paragraph","name":"4af3","text":"These are all the configuration files I’d recommend modifying. The audit.conf file you can have a look into but normally, I wouldn’t change too much there. Depending upon your environment and if you want the auditd daemon to deal with, for example, what to do when the log file is full, the audit.conf file may be worth looking into. Normally, the default value have worked for me.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_46":{"id":"d2169ee3d73a_46","__typename":"Paragraph","name":"9800","text":"What to record?","type":"H3","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_47":{"id":"d2169ee3d73a_47","__typename":"Paragraph","name":"f749","text":"The Linux audit subsystem allows us to record a lot of information. The question I look to provide some clarity to is — what’s worth recording and what isn’t?","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_48":{"id":"d2169ee3d73a_48","__typename":"Paragraph","name":"0da9","text":"First, let’s have a look at the most relevant data sources from MITRE.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_49":{"id":"d2169ee3d73a_49","__typename":"Paragraph","name":"ff51","text":"Source: https:\u002F\u002Fgithub.com\u002Fmitre-attack\u002Fattack-datasources","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:0*pca21Ou66pIzFx-6.jpg"},"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":8,"end":58,"href":"https:\u002F\u002Fgithub.com\u002Fmitre-attack\u002Fattack-datasources","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_50":{"id":"d2169ee3d73a_50","__typename":"Paragraph","name":"46ba","text":"The above graph is based on Mitre’s ATT&CK Enterprise framework and the data source that is associated by different sub-techniques in the framework. As we can see, majority of the techniques are detectable by command execution and process creation events. Reason being, these normally contain the command line executed.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":28,"end":63,"href":"https:\u002F\u002Fattack.mitre.org\u002Fmatrices\u002Fenterprise\u002F","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_51":{"id":"d2169ee3d73a_51","__typename":"Paragraph","name":"d9db","text":"Coming back to auditd, majority of these data sources can be monitored by auditd (at a price of course). Here’s my shot at correlating the above list with auditd record types that give us this information.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_52":{"id":"d2169ee3d73a_52","__typename":"Paragraph","name":"d10b","text":"Data Source to Audit Rule Mapping","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:1*PRHwxsfyvAXu3PXvP2rAMA.png"},"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_53":{"id":"d2169ee3d73a_53","__typename":"Paragraph","name":"9841","text":"Because Medium is a bitch with formatting, the above is an image. I’ve also uploaded the same here: https:\u002F\u002Fgithub.com\u002Fizysec\u002Flinux-audit\u002Fblob\u002Fmain\u002FDS-to-audit.MD","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":100,"end":162,"href":"https:\u002F\u002Fgithub.com\u002Fizysec\u002Flinux-audit\u002Fblob\u002Fmain\u002FDS-to-audit.MD","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_54":{"id":"d2169ee3d73a_54","__typename":"Paragraph","name":"665b","text":"The above list is just to help you prioritize your rule writing better. Auditd in general is going to be noisy and it’d be wise to assume performance of production systems running a security-centric auditd configuration to have an impact of at least 10–15%.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_55":{"id":"d2169ee3d73a_55","__typename":"Paragraph","name":"efc2","text":"Because auditd has so many different record types, monitoring all of them may not feasible. I’ve found that, aside from being strict with the rules you write, excluding message types can also be a nice way to trim down noise. Here are some message types I think are worth monitoring from a security perspective","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_56":{"id":"d2169ee3d73a_56","__typename":"Paragraph","name":"7d51","text":"","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:1*piomhp5PUprBgTObXUbwfw.png"},"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_57":{"id":"d2169ee3d73a_57","__typename":"Paragraph","name":"69aa","text":"When writing your audit.rules, it makes sense to explicitly specify which record types are not to be recorded. We’ve found this as a good way to reduce noise from auditd. You can do so using rules like the following","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_58":{"id":"d2169ee3d73a_58","__typename":"Paragraph","name":"7a0b","text":"-a never,exclude -F msgtype=ANOM_ACCESS_FS","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"EM","start":0,"end":42,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_59":{"id":"d2169ee3d73a_59","__typename":"Paragraph","name":"bc5b","text":"As mentioned before, each line gets evaluated so here you can, compound rules will help your performance. You can find a one-liner audit rule excluding all other audit record types than the ones in the above table on my Github here: https:\u002F\u002Fgithub.com\u002Fizysec\u002Flinux-audit\u002Fblob\u002Fmain\u002Fexclude-records.rules","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":233,"end":302,"href":"https:\u002F\u002Fgithub.com\u002Fizysec\u002Flinux-audit\u002Fblob\u002Fmain\u002Fexclude-records.rules","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_60":{"id":"d2169ee3d73a_60","__typename":"Paragraph","name":"5553","text":"Additionally, you can find the entire list of record types here. The list of main and auxiliary record types can also be found directly in the code.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":59,"end":63,"href":"https:\u002F\u002Faccess.redhat.com\u002Fdocumentation\u002Fen-us\u002Fred_hat_enterprise_linux\u002F6\u002Fhtml\u002Fsecurity_guide\u002Fsec-audit_record_types","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":136,"end":147,"href":"https:\u002F\u002Felixir.bootlin.com\u002Flinux\u002Flatest\u002Fsource\u002Finclude\u002Fuapi\u002Flinux\u002Faudit.h#L89","anchorType":"LINK","userId":null,"linkMetadata":null}]},"Paragraph:d2169ee3d73a_61":{"id":"d2169ee3d73a_61","__typename":"Paragraph","name":"db6c","text":"An event on a Linux system may trigger multiple auditd events. There is one primary event followed by auxiliary events of different record types. These auxiliary events have supporting information for the event. The number of auxiliary records an event may have depends upon the path a syscall takes through the kernel and where auditd is designed to hook into it. At the moment, there’s no mapping table between syscall and record types generated that I know of. An example of an auxiliary record would be the record type CWD which you will see many times in the audit.log. CWD records gives you the current working directory from the main event took place. But you don’t see it on the list above. Reason being, while it can be useful to know this in some cases, it’s also not the most critical piece of information when you’re trying to detect bad activity and you can make some good guesses based on the other data you have. We’re trying to even out security vs. feasibility and in doing so, you can’t have absolutely everything.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_62":{"id":"d2169ee3d73a_62","__typename":"Paragraph","name":"bce8","text":"Closing Notes","type":"H3","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_63":{"id":"d2169ee3d73a_63","__typename":"Paragraph","name":"ba46","text":"I believe auditd can indeed be used as a means for detecting threats on Linux endpoints, even in large environments. Throwing in a pre-configured rule set from the internet will give you issues however. Knowing exactly what you want to monitor and eliminating noisy events using methods described in this post, will help you arrive at a configuration suitable for even large, complex environments.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_64":{"id":"d2169ee3d73a_64","__typename":"Paragraph","name":"b10d","text":"The approach I would take is this — monitor your syscalls of interest (execve, connect) right on top followed by the files\u002Fdirectories of importance and then finally simpler rules to look for monitoring specific binaries like nmap, tshark, etc. if that’s important to you.","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"Paragraph:d2169ee3d73a_65":{"id":"d2169ee3d73a_65","__typename":"Paragraph","name":"678b","text":"I plan to write another blog dedicated to tips to better analyze audit logs as well as share sample log snippets of different activity types so you know what they look like in the logs. Not sure when I’ll get around to doing this, depends on how useful this one is to begin with. Thanks for making it this far :)","type":"P","href":null,"layout":null,"metadata":null,"hasDropCap":null,"iframe":null,"mixtapeMetadata":null,"dropCapImage":null,"markups":[]},"ImageMetadata:0*cpEg2_eJmcCq1CZW.png":{"id":"0*cpEg2_eJmcCq1CZW.png","__typename":"ImageMetadata","originalHeight":360,"originalWidth":660,"focusPercentX":null,"focusPercentY":null,"alt":null},"ImageMetadata:0*pca21Ou66pIzFx-6.jpg":{"id":"0*pca21Ou66pIzFx-6.jpg","__typename":"ImageMetadata","originalHeight":622,"originalWidth":1085,"focusPercentX":null,"focusPercentY":null,"alt":null},"ImageMetadata:1*PRHwxsfyvAXu3PXvP2rAMA.png":{"id":"1*PRHwxsfyvAXu3PXvP2rAMA.png","__typename":"ImageMetadata","originalHeight":841,"originalWidth":3355,"focusPercentX":null,"focusPercentY":null,"alt":null},"ImageMetadata:1*piomhp5PUprBgTObXUbwfw.png":{"id":"1*piomhp5PUprBgTObXUbwfw.png","__typename":"ImageMetadata","originalHeight":981,"originalWidth":1256,"focusPercentX":null,"focusPercentY":null,"alt":null},"Tag:linux":{"id":"linux","__typename":"Tag"},"Tag:blue-team":{"id":"blue-team","__typename":"Tag"},"Tag:threat-hunting":{"id":"threat-hunting","__typename":"Tag"},"Tag:cybersecurity":{"id":"cybersecurity","__typename":"Tag"},"Tag:incident-response":{"id":"incident-response","__typename":"Tag"},"User:253959469703":{"id":"253959469703","__typename":"User","imageId":"1*dmbNkD5D-u45r44go_cf0g.png","mediumMemberAt":0,"name":"Gulshan Bajaj","username":"gulshan.bajaj","customDomainState":null,"hasSubdomain":false,"bio":""},"ImageMetadata:":{"id":"","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:c956b2897e1b":{"id":"c956b2897e1b","__typename":"Post","visibility":"PUBLIC","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"Let’s understand how the body of a loop is constructed; and what happens when we go through a loop."},"collection":null,"title":"How to Iterate without any loop","mediumUrl":"https:\u002F\u002Fmedium.com\u002F@gulshan.bajaj\u002Fhow-to-iterate-without-any-loop-c956b2897e1b","creator":{"__ref":"User:253959469703"},"previewImage":{"__ref":"ImageMetadata:"},"clapCount":3,"isSeries":false,"sequence":null,"uniqueSlug":"how-to-iterate-without-any-loop-c956b2897e1b"},"Collection:9223277fc2ff":{"id":"9223277fc2ff","__typename":"Collection","slug":"paul-zhao-projects","name":"Paul Zhao Projects","domain":null},"User:c41fc7b8d27f":{"id":"c41fc7b8d27f","__typename":"User","imageId":"2*RgF17eEzwxkckQIZ89gSIw.png","mediumMemberAt":0,"name":"Paul Zhao","username":"zhaofeng8711","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"zhaofeng8711.medium.com"}},"hasSubdomain":true,"bio":"Amazon Web Service Certified Solutions Architect Professional & Devops Engineer, Digital Designer"},"ImageMetadata:0*jotJuyhgAGE-L6GG.png":{"id":"0*jotJuyhgAGE-L6GG.png","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:979d9500c868":{"id":"979d9500c868","__typename":"Post","visibility":"PUBLIC","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"Day eight— Caesar Cipher"},"collection":{"__ref":"Collection:9223277fc2ff"},"title":"Python 100 projects in 100 days — Learning Journal","mediumUrl":"https:\u002F\u002Fmedium.com\u002Fpaul-zhao-projects\u002Fpython-100-projects-in-100-days-learning-journal-979d9500c868","creator":{"__ref":"User:c41fc7b8d27f"},"previewImage":{"__ref":"ImageMetadata:0*jotJuyhgAGE-L6GG.png"},"clapCount":0,"isSeries":false,"sequence":null,"uniqueSlug":"python-100-projects-in-100-days-learning-journal-979d9500c868"},"User:ef52c08fcf87":{"id":"ef52c08fcf87","__typename":"User","imageId":"1*NQg-Bj1C53ejxqMr3Lbp9Q.jpeg","mediumMemberAt":0,"name":"Kyle W. Powers","username":"kwpowers","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"kwpowers.medium.com"}},"hasSubdomain":true,"bio":"Unity Developer, Software Engineer, Game Developer"},"ImageMetadata:1*MG4BywFD3TdzK6Ciqt9DOg.gif":{"id":"1*MG4BywFD3TdzK6Ciqt9DOg.gif","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:98d159d44fab":{"id":"98d159d44fab","__typename":"Post","visibility":"PUBLIC","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"This article will show how to create and set up a 2D character in Unity. The 2D character will be able to move around the screen and jump."},"collection":null,"title":"2D Character Setup in Unity — Movement","mediumUrl":"https:\u002F\u002Fkwpowers.medium.com\u002F2d-character-setup-in-unity-movement-98d159d44fab","creator":{"__ref":"User:ef52c08fcf87"},"previewImage":{"__ref":"ImageMetadata:1*MG4BywFD3TdzK6Ciqt9DOg.gif"},"clapCount":0,"isSeries":false,"sequence":null,"uniqueSlug":"2d-character-setup-in-unity-movement-98d159d44fab"},"User:57027854a5ea":{"id":"57027854a5ea","__typename":"User","imageId":"1*HmCwVXjcMs3z56J37pyZlw.jpeg","mediumMemberAt":0,"name":"Saronsmith","username":"saronsmith761","customDomainState":null,"hasSubdomain":false,"bio":"Director of Sales & Marketing at Web Fox"},"ImageMetadata:1*JMuijNHsmcSgjnO---g6kg.jpeg":{"id":"1*JMuijNHsmcSgjnO---g6kg.jpeg","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:f8ab46c72fe9":{"id":"f8ab46c72fe9","__typename":"Post","visibility":"PUBLIC","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"This blog would help you clear the confusion on which framework would be the right one for your web application development. You will get…"},"collection":null,"title":"Django Vs Laravel Web Development — Performance Comparison","mediumUrl":"https:\u002F\u002Fmedium.com\u002F@saronsmith761\u002Fdjango-vs-laravel-web-development-performance-comparison-f8ab46c72fe9","creator":{"__ref":"User:57027854a5ea"},"previewImage":{"__ref":"ImageMetadata:1*JMuijNHsmcSgjnO---g6kg.jpeg"},"clapCount":0,"isSeries":false,"sequence":null,"uniqueSlug":"django-vs-laravel-web-development-performance-comparison-f8ab46c72fe9"},"Collection:7f60cf5620c9":{"id":"7f60cf5620c9","__typename":"Collection","slug":"towards-data-science","name":"Towards Data Science","domain":"towardsdatascience.com"},"User:b8176fabf308":{"id":"b8176fabf308","__typename":"User","imageId":"1*aL2isee1E3zr8mzSXRiASA.png","mediumMemberAt":1566457200000,"name":"Christopher Tao","username":"qiuyujx","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"qiuyujx.medium.com"}},"hasSubdomain":true,"bio":"👁️ 2.5M+ Reads🏆7k+ Followers🥇Top 50 Writer👨‍🎓PhD💻Data Engineer\u002FMachine Learning 🤝LinkedIn https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fchristopher-tao-5717a274\u002F"},"ImageMetadata:1*otM8jk-QlanpdfCHh45zpg.jpeg":{"id":"1*otM8jk-QlanpdfCHh45zpg.jpeg","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:c2afa4200b97":{"id":"c2afa4200b97","__typename":"Post","visibility":"LOCKED","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"Everyone uses “List”, but Python does have “Array”"},"collection":{"__ref":"Collection:7f60cf5620c9"},"title":"Do You Know Python Has Built-In Array?","mediumUrl":"https:\u002F\u002Ftowardsdatascience.com\u002Fdo-you-know-python-has-built-in-array-c2afa4200b97","creator":{"__ref":"User:b8176fabf308"},"previewImage":{"__ref":"ImageMetadata:1*otM8jk-QlanpdfCHh45zpg.jpeg"},"clapCount":226,"isSeries":false,"sequence":null,"uniqueSlug":"do-you-know-python-has-built-in-array-c2afa4200b97"},"User:a5db0cb92f5b":{"id":"a5db0cb92f5b","__typename":"User","imageId":"1*dmbNkD5D-u45r44go_cf0g.png","mediumMemberAt":1633756668124,"name":"Soumya Banerjee","username":"sbanerjee01","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"sbanerjee01.medium.com"}},"hasSubdomain":true,"bio":"Building teams and distributed software systems."},"ImageMetadata:1*bou_9xkI83c9-RY4YUA7fg.png":{"id":"1*bou_9xkI83c9-RY4YUA7fg.png","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:f2a78f45a76a":{"id":"f2a78f45a76a","__typename":"Post","visibility":"PUBLIC","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"Abstract"},"collection":null,"title":"‘Exactly Once’ processing with Spark Structured Streaming","mediumUrl":"https:\u002F\u002Fsbanerjee01.medium.com\u002Fexactly-once-processing-with-spark-structured-streaming-f2a78f45a76a","creator":{"__ref":"User:a5db0cb92f5b"},"previewImage":{"__ref":"ImageMetadata:1*bou_9xkI83c9-RY4YUA7fg.png"},"clapCount":11,"isSeries":false,"sequence":null,"uniqueSlug":"exactly-once-processing-with-spark-structured-streaming-f2a78f45a76a"},"User:af18a8c5b43a":{"id":"af18a8c5b43a","__typename":"User","imageId":"1*vB8y5DvdiwH0UDLvI6Jchg.png","mediumMemberAt":1617447913000,"name":"Pawel Grajewski","username":"paulgrajewski","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"paulgrajewski.medium.com"}},"hasSubdomain":true,"bio":"web developer"},"Post:bf6339926bc9":{"id":"bf6339926bc9","__typename":"Post","visibility":"PUBLIC","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"Links:"},"collection":null,"title":"Installation python package Pillow on Windows","mediumUrl":"https:\u002F\u002Fpaulgrajewski.medium.com\u002Finstallation-python-package-pillow-on-windows-bf6339926bc9","creator":{"__ref":"User:af18a8c5b43a"},"previewImage":{"__ref":"ImageMetadata:"},"clapCount":0,"isSeries":false,"sequence":null,"uniqueSlug":"installation-python-package-pillow-on-windows-bf6339926bc9"},"Collection:a995c24848a3":{"id":"a995c24848a3","__typename":"Collection","slug":"box-developer-blog","name":"Box Developer Blog","domain":null},"User:246952a91969":{"id":"246952a91969","__typename":"User","imageId":"1*L3-AdWjDbLj1t0a8gfAULg.jpeg","mediumMemberAt":0,"name":"Alex Novotny","username":"anovotny_12970","customDomainState":null,"hasSubdomain":false,"bio":"I’m a Box Developer Advocate, helping others learn how to maximize their investment through Box Platform."},"ImageMetadata:1*KJ-miRLb-rRRWqDz4m6-yg.png":{"id":"1*KJ-miRLb-rRRWqDz4m6-yg.png","__typename":"ImageMetadata","alt":null,"focusPercentX":null,"focusPercentY":null},"Post:3fe2f70f879a":{"id":"3fe2f70f879a","__typename":"Post","visibility":"PUBLIC","previewContent":{"__typename":"PreviewContent","isFullContent":false,"subtitle":"Back in April 2021, we released a quick start guide for the Box CLI, using the JWT authentication method. We’ve now updated that guide to…"},"collection":{"__ref":"Collection:a995c24848a3"},"title":"Get started with the Box CLI in less than five minutes!","mediumUrl":"https:\u002F\u002Fmedium.com\u002Fbox-developer-blog\u002Fget-started-with-the-box-cli-in-less-than-five-minutes-3fe2f70f879a","creator":{"__ref":"User:246952a91969"},"previewImage":{"__ref":"ImageMetadata:1*KJ-miRLb-rRRWqDz4m6-yg.png"},"clapCount":1,"isSeries":false,"sequence":null,"uniqueSlug":"get-started-with-the-box-cli-in-less-than-five-minutes-3fe2f70f879a"},"User:198d1b38e7fc":{"id":"198d1b38e7fc","__typename":"User","name":"Pablo","bio":"","imageId":"0*uUiipI2YCPbOs673.jpg","mediumMemberAt":0,"username":"pablo.ambite95","customDomainState":null,"hasSubdomain":false},"User:30eb894871e7":{"id":"30eb894871e7","__typename":"User","name":"mamdouh Ahmad","bio":"","imageId":"0*GP8q-FNNP41qtqHk.","mediumMemberAt":0,"username":"skyw3lker21","customDomainState":null,"hasSubdomain":false},"User:368680099881":{"id":"368680099881","__typename":"User","name":"Suresh Thiyam","bio":"","imageId":"","mediumMemberAt":0,"username":"singh.suresh318","customDomainState":null,"hasSubdomain":false},"User:3d7a70f44446":{"id":"3d7a70f44446","__typename":"User","name":"Andreas Wienes","bio":"Well known secret superhero - Cybersecurity enthusiast #OSCP #CEH 🧙‍♂️","imageId":"1*E5BeCNBxFGqUyniZ6nzsJQ.jpeg","mediumMemberAt":1609422546000,"username":"andreaswienes","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"andreaswienes.medium.com"}},"hasSubdomain":true},"User:42a8e7a4c4d5":{"id":"42a8e7a4c4d5","__typename":"User","name":"Erix Molinie","bio":"","imageId":"0*qd3r3l_0zNuZyys5.","mediumMemberAt":1556434800000,"username":"erixbzh","customDomainState":null,"hasSubdomain":false},"User:500f3861515f":{"id":"500f3861515f","__typename":"User","name":"Eossecurecode","bio":"","imageId":"0*DtJfl2XxkmH2gHhM.jpg","mediumMemberAt":0,"username":"eossecurecode","customDomainState":null,"hasSubdomain":false},"User:54338937cc3a":{"id":"54338937cc3a","__typename":"User","name":"Charles Quaye","bio":"","imageId":"","mediumMemberAt":0,"username":"ricobandy","customDomainState":null,"hasSubdomain":false},"User:5f75ec4292a":{"id":"5f75ec4292a","__typename":"User","name":"Brendan Chamberlain","bio":"Blue Team cybersecurity professional specializing in threat detection. Python and PowerShell developer.","imageId":"1*Dl22gqFduwcQFoUvpnUHxQ.jpeg","mediumMemberAt":0,"username":"infosecb","customDomainState":{"__typename":"CustomDomainState","live":{"__typename":"CustomDomain","domain":"infosecb.medium.com"}},"hasSubdomain":true},"User:6de29deeaecf":{"id":"6de29deeaecf","__typename":"User","name":"Glynn Bevan","bio":"","imageId":"0*gZ2ppjVpvox6bYGq","mediumMemberAt":0,"username":"glynn.bevan_21646","customDomainState":null,"hasSubdomain":false}}</script><script>window.__MIDDLEWARE_STATE__={"session":{"xsrf":""},"cache":{"cacheStatus":"HIT","shouldUseCache":true}}</script><script src="https://cdn-client.medium.com/lite/static/js/manifest.a878031d.js"></script><script src="https://cdn-client.medium.com/lite/static/js/6276.742f580c.js"></script><script src="https://cdn-client.medium.com/lite/static/js/main.d1a5dfe3.js"></script><script src="https://cdn-client.medium.com/lite/static/js/5573.159bf40f.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/instrumentation.3c974b48.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/407.6b0ceaf5.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/9216.0f4f3fe8.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/AppLayout.c1278861.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/reporting.f90575a9.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/2953.ae88abbd.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/1752.a348f767.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/7794.9590314e.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/8316.18f2a6aa.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/5221.6f17437e.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/3928.4a590f9f.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/5472.5f6d4371.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/2981.a5db1477.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/5260.454ee703.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/4869.22b0b7f3.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/9401.eda78b17.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/455.28e8816e.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/7070.088d513c.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/9279.271a8c16.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/1274.7bb0abdc.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/6562.050b61a9.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/1611.47e9aab1.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/185.c7bb091e.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/864.ba8623d9.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/4351.b744650b.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/3564.b0d22ba8.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/82.02d10a80.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/5281.652a7988.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/5423.cc9ce583.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/7621.921989e2.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/8363.2f2b9025.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/PostPage.MainContent.84b2955e.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/9381.41bc9209.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/2163.cfa6e4ea.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/4554.0042da22.chunk.js"></script>
<script src="https://cdn-client.medium.com/lite/static/js/PostPage.RightColumnContent.32a89ae9.chunk.js"></script><script>window.main();</script><script defer src="https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194" integrity="sha512-Gi7xpJR8tSkrpF7aordPZQlW2DLtzUlZcumS8dMQjwDHEnw9I7ZLyiOj/6tZStRBGtGgN6ceN6cMH8z7etPGlw==" data-cf-beacon='{"rayId":"7199f31e1d9a746c","token":"0b5f665943484354a59c39c6833f7078","version":"2021.12.0","si":100}' crossorigin="anonymous"></script>
</body></html>